An issue was discovered in lib/Server.js in webpack-dev-server before 3.1.6. Attackers are able to steal developer's code because the origin of requests is not checked by the WebSocket server, which is used for HMR (Hot Module Replacement). Anyone can receive the HMR message sent by the WebSocket server via a ws://127.0.0.1:8080/ connection from any origin.
References
Link | Resource |
---|---|
https://blog.cal1.cn/post/Sniffing%20Codes%20in%20Hot%20Module%20Reloading%20Messages | Exploit Third Party Advisory |
https://github.com/webpack/webpack-dev-server/commit/f18e5adf123221a1015be63e1ca2491ca45b8d10 | Patch Third Party Advisory |
https://github.com/webpack/webpack-dev-server/issues/1445 | Exploit Third Party Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: mitre
Published: 2018-09-21T17:00:00
Updated: 2018-09-21T16:57:01
Reserved: 2018-07-28T00:00:00
Link: CVE-2018-14732
JSON object: View
NVD Information
Status : Analyzed
Published: 2018-09-21T17:29:05.373
Modified: 2019-08-01T12:14:39.407
Link: CVE-2018-14732
JSON object: View
Redhat Information
No data.
CWE