PT-2018-12688 · Unknown · Parcel-Bundler

Chromium1337 · Published 2018-09-21 · Updated 2018-11-27 · CVE-2018-14731

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions parcel-bundler versions prior to 1.10.0

Description An issue in HMRServer.js allows attackers to steal a developer's code due to the lack of origin validation on the WebSocket server used for Hot Module Replacement (HMR). This enables anyone to receive HMR messages sent by the WebSocket server via a ws://127.0.0.1 connection from any origin. The vulnerability can be exploited by finding the random TCP port number used by the WebSocket server, which can be discovered by connecting to http://127.0.0.1 and examining the source code for the "new WebSocket" line.

Recommendations Update to version 1.10.0 or later. As a temporary workaround, consider restricting access to the WebSocket server used for HMR to minimize the risk of exploitation.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2018-14731

GHSA-37Q6-576Q-VGR7

Affected Products

Parcel-Bundler

References · 11

• 🔥 https://github.com/parcel-bundler/parcel/pull/1794 · Exploit
• 🔥 https://blog.cal1.cn/post/Sniffing%20Codes%20in%20Hot%20Module%20Reloading%20Messages · Exploit
• https://github.com/parcel-bundler/parcel/issues/1783 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-37q6-576q-vgr7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-14731 · Security Note
• https://osv.dev/vulnerability/CVE-2018-14731 · Vendor Advisory
• https://github.com/parcel-bundler/parcel · Note
• https://github.com/parcel-bundler/parcel/commit/066e0bf6bd26b15c78bd47df023452e4b20073e4 · Note
• https://github.com/advisories/GHSA-37q6-576q-vgr7 · Note
• https://npmjs.com/advisories/721 · Note
• https://blog.cal1.cn/post/Sniffing%20Codes%20in%20Hot%20Module%20Reloading%20Messages) · Note