CVE-2016-10594 ipip downloads Resources over HTTP
The ipip Node.js module downloads geolocation data over HTTP, allowing attackers to perform Man-in-the-Middle attacks to intercept or modify data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2016-10594?
CVE-2016-10594 is a high-severity vulnerability in HackerOne ipip node module, published on 1 Jun 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ipip is a Node.js module to query geolocation information for an IP or domain, based on database by ipip.net. ipip downloads data resources over HTTP, which leaves it vulnerable to MITM attacks.
Which versions are affected by CVE-2016-10594?
2 open source packages ship an affected version, including ipip. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
ipip npm | All versions to 3.0.0 | None |
ipip npm | All versions to 3.0.0 | None |
Products include Ipip Project Ipip.
How do I fix CVE-2016-10594?
No fix has been published for CVE-2016-10594 yet. Limit exposure of the affected software until one is available.
Is CVE-2016-10594 being exploited?
There is no known exploitation of CVE-2016-10594 in the wild and no public exploit code.
Sources
Also known as GHSA-9gqh-q4cx-f2h9.