Kindlegen is a simple Node.js wrapper of the official kindlegen program. Kindlegen versions before 1.1.0 download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
Advisories
Source ID Title
EUVD EUVD EUVD-2019-0299 Kindlegen is a simple Node.js wrapper of the official kindlegen program. Kindlegen versions before 1.1.0 download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
Github GHSA Github GHSA GHSA-h7pc-85cg-wmch Downloads Resources over HTTP in kindlegen
Fixes

Solution

No solution given by the vendor.


Workaround

No workaround given by the vendor.

References
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: hackerone

Published:

Updated: 2024-09-17T02:36:12.983Z

Reserved: 2017-10-29T00:00:00

Link: CVE-2016-10575

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2018-06-01T18:29:00.270

Modified: 2024-11-21T02:44:18.400

Link: CVE-2016-10575

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.