CVE-2017-16035: Critical severity hubspot hubl server vulnerability
Affected versions of hubl-server insecurely download dependencies over an unencrypted HTTP connection.
In scenarios where an attacker has a privileged network position, it is possible to intercept the responses and replace the dependencies with malicious ones, resulting in code execution on the system running hubl-server.
Recommendation
No patch is currently available for this vulnerability, and it has not seen any updates since 2015.
The best mitigation is currently to avoid using this package, using a different package if available.
Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised yo
Other sources
The hubl-server module is a wrapper for the HubL Development Server. During installation hubl-server downloads a set of dependencies from api.hubapi.com. It appears in the code that these files are downloaded over HTTPS however the api.hubapi.com endpoint redirects to a HTTP url. Because of this behavior an attacker with the ability to man-in-the-middle a developer or system performing a package installation could compromise the integrity of the installation.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-16035?
CVE-2017-16035 has a high severity as it allows for potential code execution due to insecure dependency downloads.
How do I fix CVE-2017-16035?
To fix CVE-2017-16035, upgrade `hubl-server` to version 1.1.6 or later, which uses secure HTTPS connections for dependency downloads.
Which versions of hubl-server are affected by CVE-2017-16035?
Versions of `hubl-server` up to and including 1.1.5 are affected by CVE-2017-16035.
What could be the impact of exploiting CVE-2017-16035?
Exploiting CVE-2017-16035 could allow an attacker to intercept and replace dependencies with malicious code, leading to potential code execution.
What are the prerequisites for exploiting CVE-2017-16035?
An attacker needs to have a privileged network position to exploit CVE-2017-16035 and intercept insecure HTTP downloads.