CVE-2024-23657: Nuxt Devtools path traversal and authentication bypass

CVE-2024-23657 · Severity: low · CVSS 3.1 · Published 2024-08-05

Nuxt Devtools is a browser extension and local development server that enables interactive debugging and development features for Nuxt applications. By default, all new Nuxt projects enable Devtools, which can be exploited by visiting a malicious webpage to read arbitrary files from a developer's computer through path traversal attacks. In certain configurations, attackers can further extract authentication tokens and achieve remote code execution by injecting malicious code into the application.

Technologies: @nuxt/devtools (npm), Nuxt DevTools. Vendors: npm, Nuxt.

Quick answers

Is CVE-2024-23657 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2024-23657 being exploited in the wild.
How severe is CVE-2024-23657?
Low severity, with a CVSS score of 3.1, published 5 August 2024.
Which products and versions are affected?
@nuxt/devtools (npm) SEMVER:introduced=0,fixed=1.3.9; Nuxt DevTools < 1.3.9.
Is there a fix for CVE-2024-23657?
Yes. @nuxt/devtools (npm): upgrade to 1.3.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-23657 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2024-23657?
Check whether you run @nuxt/devtools (npm) or Nuxt DevTools at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @nuxt/devtools (npm): upgrade to 1.3.9 or later
    npm install @nuxt/devtools@1.3.9

Technical details

The vulnerability combines three weaknesses: (1) the getTextAssetContent RPC function lacks authentication and does not sanitize path traversal sequences (../ patterns), allowing attackers to read arbitrary files; (2) the WebSocket server accepts requests without origin validation, enabling cross-site WebSocket hijacking (CSWSH); (3) Devtools authentication tokens are stored in the user's home directory in a predictable location. An attacker can craft a malicious webpage that connects to a locally running Devtools instance, brute-force the token location via path traversal, then use authenticated RPC functions like writeStaticAssets to write executable code (Components, Handlers, or app.vue) that auto-executes. This requires the user to visit a malicious site while Devtools is running and to have previously authenticated with Devtools. Patches are available in version 1.3.9 and later.

Affected products

  • Nuxt Devtools < 1.3.9

Identifiers

  • CVE-2024-23657
  • GHSA-rcvg-rgf7-pppv

Timeline

  • 2024-08-05: disclosed
  • 2024-08-05: patched: Version 1.3.9 and later contain fixes

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.