Executive brief
easywebpack-cli is a command-line tool used to simplify Webpack builds and development server management. A security flaw in the tool's development server allows an attacker to access files outside of the intended directory. This could lead to the exposure of sensitive information, such as source code or configuration files containing database credentials, from the host machine.
Technical details
A directory traversal vulnerability exists in easywebpack-cli versions prior to 4.5.2. The vulnerability is located in the 'easy server' functionality, where the tool fails to properly sanitize user-supplied input when the -d (directory) parameter is used. An unauthenticated remote attacker can exploit this by sending a crafted GET request containing dot-dot-slash (../) sequences to traverse the file system and read arbitrary files on the host. This issue was addressed in version 4.5.2 by improving path handling.
Affected products
- easy-team easywebpack-cli < 4.5.2
Timeline
- 2020-08-18: disclosed: Issue reported on GitHub
- 2022-12-15: advisory: NVD and GitHub Advisory published