Executive brief
Parcel is a web application bundler that developers use to build and serve web applications during development. The bundler's Hot Module Replacement (HMR) feature, which enables automatic code reloading during development, was missing proper validation of request origins. This could allow unauthorized cross-origin requests to inject malicious code or hijack the development server.
Technical details
The vulnerability exists in parcel-bundler's HMRServer component, which handles hot module replacement during development. The server failed to validate the origin of incoming requests, violating the Same-Origin Policy and enabling potential cross-origin attacks. An attacker could craft a malicious webpage that, when visited by a developer running Parcel in development mode, sends requests to the HMR server without proper origin checks. This could lead to unauthorized code injection or manipulation of the development environment. The fix was introduced in version 1.10.0 (commit 066e0bf) by implementing proper origin validation in the HMRServer.js file.
Affected products
- parcel-bundler parcel-bundler < 1.10.0
Timeline
- 2018-07-24: disclosed: Vulnerability reported as issue #1783
- 2018-09-25: patched: Fix merged in PR #1794 with commit 066e0bf, released in version 1.10.0