Missing Origin Validation in webpack-dev-server

Also known as GHSA-cf66-xwfp-gvc4

Published 8 y ago 2018-09-21 · modified 4 mo ago 2026-06-17 · JSON

CVSS

7.5

v3.0 · NVD

CISA KEV

not known exploited

EPSS

2.5%

percentile 85%

Public exploits

none known

An issue was discovered in lib/Server.js in webpack-dev-server before 3.1.6. Attackers are able to steal developer's code because the origin of requests is not checked by the WebSocket server, which is used for HMR (Hot Module Replacement). Anyone can receive the HMR message sent by the WebSocket server via a ws://127.0.0.1:8080/ connection from any origin.

Exploit prediction (EPSS)

2.49% probability of exploitation in the next 30 days, higher than 85% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	7.5	`CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`
NVD	2.0	5.0	`AV:N/AC:L/Au:N/C:P/I:N/A:N`
GitHub	3.0	7.5	`CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`

Affected packages

Ecosystem	Package	Affected	Fixed in
npm	`webpack-dev-server`	<3.1.11	3.1.11

Classification

Weakness

CWE-20 Improper Input Validation

References

github.com /webpack/webpack-dev-server/issues/1445 · x_refsource_CONFIRM, x_transferred
blog.cal1.cn /post/Sniffing%20Codes%20in%20Hot%20Module%20Reloading%20Messages · x_refsource_MISC, x_transferred
github.com /webpack/webpack-dev-server/commit/f18e5adf123221a1015be63e1ca2491ca45b8d10 · x_refsource_CONFIRM, x_transferred
nvd.nist.gov /vuln/detail/CVE-2018-14732 · advisory
github.com /webpack/webpack-dev-server/issues/1620 · web
github.com /webpack/webpack-dev-server · package
github.com /webpack/webpack-dev-server/blob/master/CHANGELOG.md#3111-2018-12-21 · web
npmjs.com /advisories/725 · web

Sources

CVE List: CVE-2018-14732
GitHub Advisory: GHSA-cf66-xwfp-gvc4
NVD: CVE-2018-14732

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.