PT-2023-23680 · Nuxt · Nuxt

Published 2023-06-13 · Updated 2024-07-29 · CVE-2023-3224

Positive Technologies (AI Summary)

CVSS v4.0

9.2

Critical

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions nuxt versions prior to 3.5.3 nuxt versions 3.4.0 through 3.4.3

Description The issue concerns code injection in the Nuxt dev server. When the dev server is exposed publicly, it is vulnerable to code injection. This affects versions of nuxt prior to 3.5.3, specifically including versions 3.4.0 through 3.4.3.

Recommendations For versions 3.4.0 through 3.4.3, update to version 3.5.3 or later to resolve the issue. For versions prior to 3.5.3, update to version 3.5.3 or later to resolve the issue. As a temporary workaround, consider restricting public exposure of the Nuxt dev server until a patch is applied.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2023-3224

GHSA-GC34-5V43-H7V8

Affected Products

Nuxt

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/3xxx/CVE-2023-3224.json · Exploit
• 🔥 https://huntr.dev/bounties/1eb74fd8-0258-4c1f-a904-83b52e373a87 · Exploit
• https://github.com/nuxt/nuxt/commit/65a8f4eb3ef1b249a95fd59e323835a96428baff · Patch
• https://osv.dev/vulnerability/GHSA-gc34-5v43-h7v8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-3224 · Security Note
• https://osv.dev/vulnerability/CVE-2023-3224 · Vendor Advisory
• https://github.com/nuxt/nuxt · Note
• https://github.com/nuxt/nuxt/commit/72ba53efbc2384f802d654fffd92eaf36a81b507 · Note
• https://github.com/nuxt/nuxt/commits/v3.4.3 · Note
• https://github.com/nuxt/nuxt/issues/21694 · Note
• https://t.me/cvenotify/52712 · Telegram Post
• https://t.me/cvenotify/52233 · Telegram Post
• https://t.me/cvenotify/87784 · Telegram Post