CVE-2018-14731: Parcel parcel-bundler missing origin validation in HMR server

CVE-2018-14731 · Severity: low · CVSS 3 · Published 2018-10-30

Vendors: npm.

Executive brief

Parcel is a popular web application bundler used by developers to package their code. A security flaw in its development server allows unauthorized parties to connect to the background communication channel used for live code updates. This could allow a remote attacker to intercept and steal a developer's source code while they are working on a project.

Technical details

The HMRServer.js component in parcel-bundler fails to validate the 'Origin' header of incoming WebSocket requests. This allows an attacker to establish a connection to the HMR WebSocket server (typically running on a random TCP port on 127.0.0.1) from any web origin. By reading the 'new WebSocket' line in the source code of the local development server, an attacker can identify the correct port and subsequently receive HMR messages containing the application's source code. This is classified as an information exposure vulnerability (CWE-200) and was fixed in version 1.10.0 by implementing origin checks.

Affected products

Parcel parcel-bundler < 1.10.0

Timeline

2018-07-24: disclosed: Vulnerability reported to vendor via GitHub issue
2018-09-21: advisory: NVD published CVE-2018-14731
2018-09-25: patched: Fix merged into master branch
2018-10-30: advisory: GitHub Advisory published

References

Related threats

parcel-bundler missing origin validation in HMR