Executive brief
webpack-subresource-integrity is a plugin that strengthens web application security by ensuring loaded code hasn't been tampered with. In version 1.5.0, dynamically loaded code chunks receive invalid integrity hashes that browsers ignore, eliminating this tamper-detection protection for those chunks. This could allow a network attacker to inject malicious code into dynamically loaded portions of an application if they can intercept the connection. The issue is fixed in version 1.5.1.
Technical details
The vulnerability is a Subresource Integrity (SRI) bypass in webpack-subresource-integrity version 1.5.0. The plugin generates an integrity attribute with the value "undefined" for dynamically loaded chunks instead of computing the correct hash digest. Since browsers ignore invalid SRI attributes, integrity validation is skipped entirely for these resources, allowing unsigned or malicious chunks to load without detection. The issue affects only dynamic chunks; top-level/entry chunks are unaffected. Attack requires network-level access to intercept chunk requests (e.g., man-in-the-middle on unencrypted or compromised HTTPS connections). The fix was released in version 1.5.1 and corrects the hash lookup logic for dynamic chunks.
Affected products
- waysact webpack-subresource-integrity 1.5.0
Timeline
- 2020-10-19: disclosed
- 2020-10-19: patched: Fixed in version 1.5.1
References
- https://github.com/waysact/webpack-subresource-integrity/security/advisories/GHSA-4fc4-chg7-h8gh
- https://github.com/waysact/webpack-subresource-integrity/issues/131
- https://github.com/waysact/webpack-subresource-integrity/commit/3d7090c08c333fcfb10ad9e2d6cf72e2acb7d87f
- https://github.com/waysact/webpack-subresource-integrity