CVE-2018-14732

NONE EPSS 82.3%
Published Sep 21, 20187y ago · Modified Jun 17, 20262w ago
Find Similar
Published Sep 21, 2018 7y ago
Last Modified Jun 17, 2026 2w ago

Description

An issue was discovered in lib/Server.js in webpack-dev-server before 3.1.6. Attackers are able to steal developer's code because the origin of requests is not checked by the WebSocket server, which is used for HMR (Hot Module Replacement). Anyone can receive the HMR message sent by the WebSocket server via a ws://127.0.0.1:8080/ connection from any origin.

Threat Intelligence

EPSS Exploit Probability
82.3% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-20 Improper Input Validation Validation

Affected Products 1

VendorProductVersionRange
webpack.jswebpack-dev-server* <3.1.6

References 3

  • blog.cal1.cn https://blog.cal1.cn/post/Sniffing%20Codes%20in%20Hot%20Module%20Reloading%20Messages
    ExploitThird Party Advisory
  • github.com https://github.com/webpack/webpack-dev-server/commit/f18e5adf123221a1015be63e1ca2491ca45b8d10
    PatchThird Party Advisory
  • github.com https://github.com/webpack/webpack-dev-server/issues/1445
    ExploitThird Party Advisory

Remediation

  • github.com https://github.com/webpack/webpack-dev-server/commit/f18e5adf123221a1015be63e1ca2491ca45b8d10
    PatchThird Party Advisory