PT-2018-12687 · Browserify · Browserify-Hmr

Publicado 2018-09-21 · Atualizado 2020-09-01 · CVE-2018-14730

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions browserify-hmr versions prior to 0.4.0

Description An issue was discovered where the origin of requests is not checked by the WebSocket server used for Hot Module Replacement (HMR), allowing attackers to steal a developer's code. The WebSocket server, accessible via a ws://127.0.0.1:3123/ connection, does not validate the origin of requests, making it possible for anyone to receive HMR messages sent by the server from any origin.

Recommendations Upgrade to version 0.4.0 or later. As a temporary workaround, consider restricting access to the WebSocket server to minimize the risk of exploitation.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2018-14730

GHSA-77Q4-M83Q-W76V

Produtos afetados

Browserify-Hmr

Referências · 8

• 🔥 https://blog.cal1.cn/post/Sniffing%20Codes%20in%20Hot%20Module%20Reloading%20Messages · Exploit
• https://github.com/AgentME/browserify-hmr · Nota
• https://github.com/AgentME/browserify-hmr/issues/41 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-14730 · Nota de Segurança
• https://npmjs.com/advisories/726 · Nota
• https://osv.dev/vulnerability/CVE-2018-14730 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-77q4-m83q-w76v · Aviso do Fabricante
• https://blog.cal1.cn/post/Sniffing%20Codes%20in%20Hot%20Module%20Reloading%20Messages) · Nota