CVE-2021-21373
📋 TL;DR
This vulnerability in Nimble package manager allows man-in-the-middle attackers to intercept package list downloads and inject malicious packages. When users install these packages, it leads to remote code execution. Affects Nim developers using Nimble before versions 1.2.10 or 1.4.4.
💻 Affected Systems
- Nimble package manager
📦 What is this software?
Nim by Nim Lang
Nim by Nim Lang
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise through malicious package installation leading to remote code execution, data theft, and persistent backdoors.
Likely Case
Attackers intercepting unencrypted package list downloads to inject malicious packages that get installed by developers.
If Mitigated
No impact if using patched versions or if network controls prevent HTTP fallback to untrusted sources.
🎯 Exploit Status
Attack requires man-in-the-middle position on network traffic.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Nim 1.2.10 or 1.4.4
Vendor Advisory: https://github.com/nim-lang/security/security/advisories/GHSA-8w52-r35x-rgp8
Restart Required: No
Instructions:
1. Update Nim to version 1.2.10 or 1.4.4. 2. Run 'nimble refresh' to update package lists. 3. Verify no HTTP fallback occurs.
🔧 Temporary Workarounds
Disable HTTP fallback
allConfigure Nimble to never fall back to HTTP when HTTPS fails
export NIMBLE_NO_HTTP_FALLBACK=1
Use trusted package mirrors
allConfigure Nimble to use only trusted HTTPS package sources
nimble config set packageList "https://trusted-mirror.example.com/packages.json"
🧯 If You Can't Patch
- Avoid using 'nimble refresh' on untrusted networks
- Monitor network traffic for HTTP connections to irclogs.nim-lang.org
🔍 How to Verify
Check if Vulnerable:
Check Nim version with 'nim --version' and verify it's below 1.2.10 or 1.4.4Check Version:
nim --versionVerify Fix Applied:
After update, run 'nimble refresh' and check network traffic shows only HTTPS connections📡 Detection & Monitoring
Log Indicators:
- HTTP connections to irclogs.nim-lang.org in network logs
- Failed HTTPS attempts followed by HTTP fallback
Network Indicators:
- Outbound HTTP traffic to port 80 of irclogs.nim-lang.org during nimble operations
SIEM Query:
destination_port:80 AND destination_ip:irclogs.nim-lang.org AND process_name:nimble🔗 References
- https://consensys.net/diligence/vulnerabilities/nim-insecure-ssl-tls-defaults-remote-code-execution/
- https://github.com/nim-lang/nimble/blob/master/changelog.markdown#0130
- https://github.com/nim-lang/security/security/advisories/GHSA-8w52-r35x-rgp8
- https://consensys.net/diligence/vulnerabilities/nim-insecure-ssl-tls-defaults-remote-code-execution/
- https://github.com/nim-lang/nimble/blob/master/changelog.markdown#0130
- https://github.com/nim-lang/security/security/advisories/GHSA-8w52-r35x-rgp8
