Executive brief
Wrangler is a development tool used by engineers to build and test Cloudflare Workers applications locally. A flaw in its dev server could allow an attacker on the local network—or someone who tricks a user into visiting a malicious website—to read any file on that user's computer. This could expose source code, credentials, configuration files, and other sensitive data stored locally.
Technical details
The vulnerability is an improper access control issue (CWE-287) in Wrangler's dev server that fails to restrict which files can be served over HTTP. By sending specially crafted HTTP requests and inspector protocol messages, an attacker can read arbitrary files on the host system, bypassing the intended bundle-based access restrictions. The attack vector is adjacent network (AV:A) with high attack complexity (AC:H), requiring the attacker to be on the local network or trick a user into visiting a malicious website. The vulnerability affects versions 3.9.0 through 3.18.x and was patched in version 3.19.0, which now serves only files within the bundle or referenced by source maps. A partial workaround exists by configuring Wrangler to listen only on 127.0.0.1.
Affected products
- Cloudflare Wrangler 3.9.0 to 3.18.x
Timeline
- 2023-12-29: disclosed
- 2024-01-03: patched: Fixed in wrangler@3.19.0