PT-2018-12687 · Browserify · Browserify-Hmr

Published 2018-09-21 · Updated 2020-09-01 · CVE-2018-14730

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions browserify-hmr versions prior to 0.4.0

Description An issue was discovered where the origin of requests is not checked by the WebSocket server used for Hot Module Replacement (HMR), allowing attackers to steal a developer's code. The WebSocket server, accessible via a ws://127.0.0.1:3123/ connection, does not validate the origin of requests, making it possible for anyone to receive HMR messages sent by the server from any origin.

Recommendations Upgrade to version 0.4.0 or later. As a temporary workaround, consider restricting access to the WebSocket server to minimize the risk of exploitation.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2018-14730

GHSA-77Q4-M83Q-W76V

Affected Products

Browserify-Hmr

References · 8

• 🔥 https://blog.cal1.cn/post/Sniffing%20Codes%20in%20Hot%20Module%20Reloading%20Messages · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-14730 · Security Note
• https://osv.dev/vulnerability/CVE-2018-14730 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-77q4-m83q-w76v · Vendor Advisory
• https://github.com/AgentME/browserify-hmr · Note
• https://github.com/AgentME/browserify-hmr/issues/41 · Note
• https://npmjs.com/advisories/726 · Note
• https://blog.cal1.cn/post/Sniffing%20Codes%20in%20Hot%20Module%20Reloading%20Messages) · Note