Executive brief
webpack-bundle-analyzer is a plugin used by developers to visualize and analyze the size of webpack build output bundles. Versions prior to 3.3.2 fail to properly escape user-controlled input when generating HTML output, allowing an attacker to inject malicious JavaScript code that executes in the browser of anyone viewing the bundle analysis report. This could enable account takeover, data theft, or malware installation on developer machines.
Technical details
The vulnerability is a reflected Cross-Site Scripting (CWE-79) flaw in webpack-bundle-analyzer's bundle analysis HTML output. The root cause is improper escaping of input when using JSON.stringify() to serialize bundle data into the HTML page. An attacker can craft a malicious bundle or bundle name containing JavaScript code that bypasses the escaping mechanism. The attack vector is network-based with low attack complexity and requires user interaction (opening a report); no authentication is required. A successful exploit allows execution of arbitrary JavaScript in the context of the affected user's browser. The vulnerability was patched in version 3.3.2, which implements proper HTML entity escaping.
Affected products
- webpack webpack-bundle-analyzer prior to 3.3.2
Timeline
- 2019-05-23: disclosed
- 2019-04-11: patched: Fix merged in pull request #264