PT-2025-5342 · Nuxt+1 · Nuxt+1

Ivantsepp · Published 2025-01-21 · Updated 2025-01-27 · CVE-2025-24360

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nuxt versions 3.8.1 through 3.15.2

Description The issue arises due to default CORS settings in Nuxt, allowing any website to send requests to the development server and read the response. This can lead to source code theft by malicious websites, especially for users with the default server.cors option using Vite builder. The vulnerability can be exploited even if the development server is only accessible locally and not exposed to the network. There are three main causes: permissive default CORS settings, lack of validation on the Origin header for WebSocket connections, and lack of validation on the Host header for HTTP requests. These can allow attackers to steal source code, access functionalities not meant to be exposed, and exploit certain plugin functionalities.

Recommendations For Nuxt versions 3.8.1 through 3.15.2, upgrade to version 3.15.3 or later to fix the vulnerability. If using the backend integration feature, add the origin of the backend server to the server.cors.origin option, ensuring a specific origin is set rather than '*'. If using a reverse proxy in front of Nuxt, add the hostname to the new server.allowedHosts option. If accessing the development server via a domain other than localhost or *.localhost, add the hostname to the server.allowedHosts option. For users of plugins that connect to the WebSocket server on their own from the browser, try upgrading to a newer version of Nuxt that fixes the vulnerability. If the WebSocket connection appears not to be working, either fix the plugin code to make it compatible with the new version of Nuxt or set legacy.skipWebSocketTokenCheck: true, being aware of the security implications. As a temporary workaround, consider setting server.cors to false or limiting server.cors.origin to trusted origins to mitigate the risk of source code theft.

Exploit

Fix

Origin Validation Error

Information Disclosure

Weakness Enumeration

CWE-350

CWE-1385

CWE-346

CWE-200

Related Identifiers

CVE-2025-24360

GHSA-2452-6XJ8-JH47

GHSA-VG6X-RCGG-RJX6

Affected Products

Nuxt

Vite

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/24xxx/CVE-2025-24360.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-24010 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-24360 · Security Note
• https://osv.dev/vulnerability/CVE-2025-24360 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vg6x-rcgg-rjx6 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2452-6xj8-jh47 · Vendor Advisory
• https://github.com/vitejs/vite · Note
• https://github.com/vitejs/vite/security/advisories/GHSA-vg6x-rcgg-rjx6 · Note
• https://github.com/nuxt/nuxt · Note
• https://github.com/nuxt/nuxt/blob/7d345c71462d90187fd09c96c7692f306c90def5/packages/vite/src/client.ts#L257-L263 · Note
• https://github.com/nuxt/nuxt/pull/23995 · Note
• https://github.com/nuxt/nuxt/blob/7d345c71462d90187fd09c96c7692f306c90def5/packages/vite/src/vite-node.ts#L39 · Note
• https://github.com/nuxt/nuxt/commit/7eeb910bf4accb1e0193b9178c746f06ad3dd88f · Note
• https://github.com/nuxt/nuxt/security/advisories/GHSA-2452-6xj8-jh47 · Note
• https://t.me/cvedetector/16358 · Telegram Post