Executive brief
webpack-dev-server is a development server used by JavaScript developers to test and debug applications locally. The Hot Module Replacement (HMR) feature uses a WebSocket connection to enable live code updates without manual reloading. Due to missing origin validation, an attacker on the network can exploit this to steal a developer's source code by intercepting and reading messages intended only for legitimate development sessions.
Technical details
The vulnerability is an improper input validation issue (CWE-20) in the WebSocket server used for Hot Module Replacement in webpack-dev-server versions prior to 3.1.11. The WebSocket server fails to validate the Origin header of incoming requests, allowing any remote attacker to establish a connection and receive source code being served to legitimate developers. This is a network-level attack requiring no authentication or user interaction—an attacker can simply craft a malicious web page that connects to a developer's local webpack-dev-server and extracts source code. The fix was released in version 3.1.11, which adds proper origin validation.
Affected products
- webpack webpack-dev-server before 3.1.11
Timeline
- 2018-07-24: disclosed: Vulnerability reported to webpack-dev-server project
- 2018-12-21: patched: Fixed in version 3.1.11
- 2019-01-04: advisory: GHSA-cf66-xwfp-gvc4 published