Executive brief
browserify-hmr is a JavaScript development tool that enables hot module replacement (HMR) during development, allowing developers to see code changes instantly without restarting. Versions before 0.4.0 fail to validate the origin of websocket connections, allowing remote attackers to connect to a developer's HMR server and steal their source code during development.
Technical details
The vulnerability is a missing origin validation flaw in the websocket server component used for Hot Module Replacement. The HMR websocket server in browserify-hmr prior to version 0.4.0 does not validate the origin header of incoming websocket connections, allowing cross-origin requests. An attacker can connect to an exposed HMR websocket server from a remote origin and intercept source code and development assets transmitted through the HMR protocol. This is a network-reachable vulnerability requiring no authentication; the attack surface is limited to development environments where the HMR server is accessible over the network. The issue was fixed in version 0.4.0 by adding proper origin validation.
Affected products
- npm browserify-hmr before 0.4.0
Timeline
- 2020-09-01: disclosed