Executive brief
A security vulnerability exists in react-dev-utils, a tool used by developers to build React applications. On Windows systems, the tool's local development server fails to properly check commands sent to it, which could allow an attacker to remotely run malicious code on a developer's computer. This could lead to the theft of source code, credentials, or full control over the developer's workstation.
Technical details
A command injection vulnerability (CWE-78) exists in react-dev-utils when running on Windows. The package's local development web server accepts commands to launch an editor but fails to properly sanitize the input provided to these commands. An attacker can exploit this by making a network request to the local server—either directly or via Cross-Site Request Forgery (CSRF)—to execute arbitrary OS commands. The fix involves implementing a strict whitelist for user-provided filenames to prevent shell metacharacters from being processed. Patches are available in versions 1.0.4, 2.0.2, 3.1.2, 4.2.2, and 5.0.2.
Affected products
- Facebook react-dev-utils >= 1.0.0, < 1.0.4; >= 2.0.0, < 2.0.2; >= 3.0.0, < 3.1.2; >= 4.0.0, < 4.2.2; >= 5.0.0, < 5.0.2
Timeline
- 2018-08-08: patched: Pull request 4866 submitted to address RCE
- 2018-12-31: disclosed: NVD publication date
- 2019-01-04: advisory: GitHub Advisory published