An issue was discovered in lib/Server.js in webpack-dev-server before 3.1.6. Attackers are able to steal developer's code because the origin of requests is not checked by the WebSocket server, which is used for HMR (Hot Module Replacement). Anyone can receive the HMR message sent by the WebSocket server via a ws://127.0.0.1:8080/ connection from any origin.

Threat-Mapped Scoring

Score: 0.0

Priority: Unclassified

EPSS

Score: 0.00386
Percentile: 0.58948

CVSS Scoring

Mapped CWE(s)

• CWE-20 : Improper Input Validation

All CAPEC(s)

CAPEC(s) with Mapped TTPs

Mapped ATT&CK TTPs

• T1562.003 : Impair Command History Logging
  Kill Chain: defense-evasion
• T1574.006 : Dynamic Linker Hijacking
  Kill Chain: persistence
• T1574.007 : Path Interception by PATH Environment Variable
  Kill Chain: persistence
• T1027 : Obfuscated Files or Information
  Kill Chain: defense-evasion
• T1539 : Steal Web Session Cookie
  Kill Chain: credential-access
• T1036.001 : Invalid Code Signature
  Kill Chain: defense-evasion
• T1553.002 : Code Signing
  Kill Chain: defense-evasion

Malware

APTs Threat Group Associations

Campaigns

Affected Products

• cpe:2.3:a:webpack.js:webpack-dev-server:*:*:*:*:*:*:*:*

← Back to Home