Is CVE-2023-7080 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2023-7080 being exploited in the wild.

How severe is CVE-2023-7080?

Low severity, with a CVSS score of 3.1, published 3 January 2024.

Which products and versions are affected?

wrangler (npm) SEMVER:introduced=3.0.0,fixed=3.19.0.

Is there a fix for CVE-2023-7080?

Yes. wrangler (npm): upgrade to 3.19.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2023-7080 attacked?

It is attacked from the adjacent network or over the network.

Am I affected by CVE-2023-7080?

Check whether you run wrangler (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2023-7080: Cloudflare Wrangler arbitrary code execution in dev inspector

CVE-2023-7080 · Severity: low · CVSS 3.1 · Published 2024-01-03

Wrangler is a developer tool used to build and test Cloudflare Workers serverless applications. The development server (`wrangler dev`) exposed a V8 debugging inspector on all network interfaces without proper access controls, allowing attackers on the local network or via malicious websites to execute arbitrary code within the Workers sandbox and potentially access production resources.

Technologies: wrangler (npm). Vendors: npm.

Quick answers

Is CVE-2023-7080 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2023-7080 being exploited in the wild.
How severe is CVE-2023-7080?: Low severity, with a CVSS score of 3.1, published 3 January 2024.
Which products and versions are affected?: wrangler (npm) SEMVER:introduced=3.0.0,fixed=3.19.0.
Is there a fix for CVE-2023-7080?: Yes. wrangler (npm): upgrade to 3.19.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-7080 attacked?: It is attacked from the adjacent network or over the network.
Am I affected by CVE-2023-7080?: Check whether you run wrangler (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

wrangler (npm): upgrade to 3.19.0 or later
```
npm install wrangler@3.19.0
```

Technical details

The V8 inspector in `wrangler dev` intentionally allows arbitrary code execution for debugging purposes, but was exposed on all network interfaces without Origin/Host header validation. This enabled two attack vectors: (1) a direct network-based attack where an attacker on the same local network could connect directly to the inspector and execute code, and (2) a cross-origin attack where a user visiting a malicious website could be tricked into connecting to the inspector. When using `wrangler dev --remote`, this could grant attackers access to production resources bound to the worker. Patches were released in wrangler v3.19.0 and v2.20.2 with Origin/Host header validation; earlier mitigations included binding the inspector to localhost (v3.16.0) and SSRF vulnerability fixes in miniflare (v3.18.0).

Affected products

Cloudflare Wrangler >=2.0.0, <2.20.2 and >=3.0.0, <3.19.0

Identifiers

CVE-2023-7080
GHSA-f8mp-x433-5wpf

Timeline

2023-12-29: disclosed
2024-01-03: patched: wrangler v3.19.0 and v2.20.2 released with fixes

References

https://github.com/cloudflare/workers-sdk/security/advisories/GHSA-f8mp-x433-5wpf

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.