Sparkle version vulnerable to MitM attack

Atelier-Shiori / malupdaterosx-cocoa

Native MyAnimeList Scrobbler for macOS

https://malupdaterosx.moe/malupdaterosx/

BSD 3-Clause "New" or "Revised" License

24 stars 3 forks source link

Sparkle version vulnerable to MitM attack #17

Closed vgerak closed 8 years ago

vgerak commented 8 years ago

The Sparkle framework version used is vulnerable to a Man-in-the-Middle attack, when the appcast or release notes are sent over an unsecured (HTTP) channel.

This app uses Sparkle version 1.8.0 and http://chikorita157.com/tools/malupdatersparkle/profileInfo.php as the update link, so it is vulnerable.

I would suggest using a more recent Sparkle version.

More info on Sparkle website

moyitpro commented 8 years ago

I will update the framework, but just to note that all the links on the domain chikorita157.com now redirects to HTTPs permanently. I will be updating that link to use https in the next update.

moyitpro commented 8 years ago

Fixed with https://github.com/chikorita157/malupdaterosx-cocoa/commit/dc6c9854db2307f3064391615308a57a77b70cbe