Executive brief
Nuxt Devtools is a browser extension and local development server that enables interactive debugging and development features for Nuxt applications. By default, all new Nuxt projects enable Devtools, which can be exploited by visiting a malicious webpage to read arbitrary files from a developer's computer through path traversal attacks. In certain configurations, attackers can further extract authentication tokens and achieve remote code execution by injecting malicious code into the application.
Technical details
The vulnerability combines three weaknesses: (1) the getTextAssetContent RPC function lacks authentication and does not sanitize path traversal sequences (../ patterns), allowing attackers to read arbitrary files; (2) the WebSocket server accepts requests without origin validation, enabling cross-site WebSocket hijacking (CSWSH); (3) Devtools authentication tokens are stored in the user's home directory in a predictable location. An attacker can craft a malicious webpage that connects to a locally running Devtools instance, brute-force the token location via path traversal, then use authenticated RPC functions like writeStaticAssets to write executable code (Components, Handlers, or app.vue) that auto-executes. This requires the user to visit a malicious site while Devtools is running and to have previously authenticated with Devtools. Patches are available in version 1.3.9 and later.
Affected products
- Nuxt Devtools < 1.3.9
Timeline
- 2024-08-05: disclosed
- 2024-08-05: patched: Version 1.3.9 and later contain fixes