An issue was discovered in Browserify-HMR. Attackers are able to steal developer's code because the origin of requests is not checked by the WebSocket server, which is used for HMR (Hot Module Replacement). Anyone can receive the HMR message sent by the WebSocket server via a ws://127.0.0.1:3123/ connection from any origin.
References
Link | Resource |
---|---|
https://blog.cal1.cn/post/Sniffing%20Codes%20in%20Hot%20Module%20Reloading%20Messages | Exploit Third Party Advisory |
https://github.com/AgentME/browserify-hmr/issues/41 | Third Party Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: mitre
Published: 2018-09-21T17:00:00
Updated: 2018-09-21T16:57:01
Reserved: 2018-07-28T00:00:00
Link: CVE-2018-14730
JSON object: View
NVD Information
Status : Analyzed
Published: 2018-09-21T17:29:04.983
Modified: 2020-06-10T12:45:15.310
Link: CVE-2018-14730
JSON object: View
Redhat Information
No data.
CWE