PT-2024-3876 · Webpack · Webpack-Dev-Middleware+1

Palirichtarik · Published 2024-03-21 · Updated 2026-02-18 · CVE-2024-29180

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions: webpack-dev-middleware versions prior to 7.1.0 webpack-dev-middleware versions prior to 6.1.2 webpack-dev-middleware versions prior to 5.3.4

Description: The webpack-dev-middleware does not sufficiently validate the supplied URL address before returning the local file, potentially allowing access to any file on the developer's machine. The middleware can operate with either the physical filesystem (when writeToDisk is set to true) or a virtualized in-memory memfs filesystem. The getFilenameFromUrl method parses the URL and constructs the local file path. Because the URL is not automatically unescaped and normalized before processing, sequences like %2e and %2f can be used to perform a path traversal attack. Developers using webpack-dev-server or webpack-dev-middleware are affected. An attacker could potentially access and exfiltrate files from the developer's machine, especially if the development server is listening on a public IP address or allows access from third-party domains.

Recommendations: Update to webpack-dev-middleware version 7.1.0 or later. Update to webpack-dev-middleware version 6.1.2 or later. Update to webpack-dev-middleware version 5.3.4 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2024-04278

CVE-2024-29180

GHSA-WR3J-PWJ9-HQQ6

Affected Products

Webpack-Dev-Middleware

Webpack-Dev-Server

References · 26

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/29xxx/CVE-2024-29180.json · Exploit
• https://github.com/webpack/webpack-dev-middleware/commit/189c4ac7d2344ec132a4689e74dc837ec5be0132 · Patch
• https://github.com/webpack/webpack-dev-middleware/security/advisories/GHSA-wr3j-pwj9-hqq6 · Vendor Advisory
• https://github.com/webpack/webpack-dev-middleware/blob/7ed24e0b9f53ad1562343f9f517f0f0ad2a70377/src/utils/setupOutputFileSystem.js#L21 · Patch
• https://github.com/webpack/webpack-dev-middleware/blob/7ed24e0b9f53ad1562343f9f517f0f0ad2a70377/src/utils/getFilenameFromUrl.js#L82 · Patch
• https://github.com/webpack/webpack-dev-middleware/commit/9670b3495da518fe667ff3428c5e4cb9f2f3d353 · Patch
• https://github.com/webpack/webpack-dev-middleware/commit/e10008c762e4d5821ed6990348dabf0d4d93a10e · Patch
• https://osv.dev/vulnerability/GHSA-wr3j-pwj9-hqq6 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-29180 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-29180 · Security Note
• https://bdu.fstec.ru/vul/2024-04278 · Security Note
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2024-29180 · Vendor Advisory
• https://github.com/webpack/webpack-dev-middleware · Note
• https://github.com/webpack/webpack-dev-middleware/releases/tag/v5.3.4 · Note
• https://github.com/webpack/webpack-dev-middleware/releases/tag/v6.1.2 · Note