An issue was discovered in Browserify-HMR. Attackers are able to steal developer's code because the origin of requests is not checked by the WebSocket server, which is used for HMR (Hot Module Replacement). Anyone can receive the HMR message sent by the WebSocket server via a ws://127.0.0.1:3123/ connection from any origin.

Threat-Mapped Scoring

Score: 0.0

Priority: Unclassified

EPSS

Score: 0.00316
Percentile: 0.54128

CVSS Scoring

Mapped CWE(s)

• CWE-200 : Exposure of Sensitive Information to an Unauthorized Actor

All CAPEC(s)

CAPEC(s) with Mapped TTPs

Mapped ATT&CK TTPs

• T1562.003 : Impair Command History Logging
  Kill Chain: defense-evasion
• T1574.006 : Dynamic Linker Hijacking
  Kill Chain: persistence
• T1574.007 : Path Interception by PATH Environment Variable
  Kill Chain: persistence
• T1217 : Browser Information Discovery
  Kill Chain: discovery
• T1592 : Gather Victim Host Information
  Kill Chain: reconnaissance
• T1595 : Active Scanning
  Kill Chain: reconnaissance
• T1018 : Remote System Discovery
  Kill Chain: discovery
• T1124 : System Time Discovery
  Kill Chain: discovery
• T1046 : Network Service Discovery
  Kill Chain: discovery
• T1016 : System Network Configuration Discovery
  Kill Chain: discovery
• T1049 : System Network Connections Discovery
  Kill Chain: discovery
• T1590 : Gather Victim Network Information
  Kill Chain: reconnaissance
• T1082 : System Information Discovery
  Kill Chain: discovery
• T1082 : System Information Discovery
  Kill Chain: discovery
• T1083 : File and Directory Discovery
  Kill Chain: discovery
• T1057 : Process Discovery
  Kill Chain: discovery
• T1007 : System Service Discovery
  Kill Chain: discovery
• T1087 : Account Discovery
  Kill Chain: discovery
• T1069 : Permission Groups Discovery
  Kill Chain: discovery
• T1615 : Group Policy Discovery
  Kill Chain: discovery
• T1033 : System Owner/User Discovery
  Kill Chain: discovery
• T1134.001 : Token Impersonation/Theft
  Kill Chain: defense-evasion
• T1550.004 : Web Session Cookie
  Kill Chain: defense-evasion
• T1036.005 : Match Legitimate Resource Name or Location
  Kill Chain: defense-evasion
• T1135 : Network Share Discovery
  Kill Chain: discovery
• T1120 : Peripheral Device Discovery
  Kill Chain: discovery
• T1111 : Multi-Factor Authentication Interception
  Kill Chain: credential-access

Malware

APTs Threat Group Associations

Campaigns

Affected Products

• cpe:2.3:a:browserify-hot_module_replacement_project:browserify-hot_module_replacement:-:*:*:*:*:browserify:*:*

← Back to Home