Code Sniffing

2018-09-2409:31:27

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.003 Low

EPSS

Percentile

68.5%

JSON

webpack-dev-server is vulnerable to code sniffing. The code sniffing is possible because WebSocket server for HMR (Hot Module Replacement) does not validate the origin of the request, allowing unauthorised users to access HMR message sent by the WebSocket server via a ws://127.0.0.1:8080/ connection from any origin.

CPENameOperatorVersion
webpack-dev-serverle3.0.0-beta.2
webpack-dev-serverle3.1.10

CPE	Name	Operator	Version
	webpack-dev-server	le	3.0.0-beta.2
	webpack-dev-server	le	3.1.10

References

blog.cal1.cn/post/Sniffing%20Codes%20in%20Hot%20Module%20Reloading%20Messages

github.com/webpack/webpack-dev-server/issues/1445

0.003 Low

EPSS

Percentile

68.5%

JSON

Related for VERACODE:7523