PT-2018-12688 · Unknown · Parcel-Bundler

Chromium1337 · Publicado 2018-09-21 · Atualizado 2018-11-27 · CVE-2018-14731

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions parcel-bundler versions prior to 1.10.0

Description An issue in HMRServer.js allows attackers to steal a developer's code due to the lack of origin validation on the WebSocket server used for Hot Module Replacement (HMR). This enables anyone to receive HMR messages sent by the WebSocket server via a ws://127.0.0.1 connection from any origin. The vulnerability can be exploited by finding the random TCP port number used by the WebSocket server, which can be discovered by connecting to http://127.0.0.1 and examining the source code for the "new WebSocket" line.

Recommendations Update to version 1.10.0 or later. As a temporary workaround, consider restricting access to the WebSocket server used for HMR to minimize the risk of exploitation.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2018-14731

GHSA-37Q6-576Q-VGR7

Produtos afetados

Parcel-Bundler

Referências · 11

• 🔥 https://github.com/parcel-bundler/parcel/pull/1794 · Exploit
• 🔥 https://blog.cal1.cn/post/Sniffing%20Codes%20in%20Hot%20Module%20Reloading%20Messages · Exploit
• https://github.com/parcel-bundler/parcel/issues/1783 · Aviso do Fabricante
• https://github.com/parcel-bundler/parcel · Nota
• https://github.com/parcel-bundler/parcel/commit/066e0bf6bd26b15c78bd47df023452e4b20073e4 · Nota
• https://osv.dev/vulnerability/GHSA-37q6-576q-vgr7 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-14731 · Nota de Segurança
• https://github.com/advisories/GHSA-37q6-576q-vgr7 · Nota
• https://npmjs.com/advisories/721 · Nota
• https://osv.dev/vulnerability/CVE-2018-14731 · Aviso do Fabricante
• https://blog.cal1.cn/post/Sniffing%20Codes%20in%20Hot%20Module%20Reloading%20Messages) · Nota