Bug 2270863 (CVE-2024-29180) - CVE-2024-29180 webpack-dev-middleware: lack of URL validation may lead to file leak
Summary: CVE-2024-29180 webpack-dev-middleware: lack of URL validation may lead to fil...
Keywords:
Status: NEW
Alias: CVE-2024-29180
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2270872 2275594 2311122 2311123 2311124 2270864 2270865 2270866 2270867 2270868 2270869 2270870 2270871 2275265 2302847
Blocks: 2270877
TreeView+ depends on / blocked
 
Reported: 2024-03-21 21:36 UTC by Marco Benatto
Modified: 2025-04-18 08:27 UTC (History)
113 users (show)

Fixed In Version: webpack-dev-middleware 5.3.4, webpack-dev-middleware 6.1.2, webpack-dev-middleware 7.1.0
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2024:0041 0 None None None 2024-06-27 11:24:40 UTC
Red Hat Product Errata RHSA-2024:2815 0 None None None 2024-05-10 19:06:39 UTC
Red Hat Product Errata RHSA-2024:2816 0 None None None 2024-05-10 19:16:52 UTC
Red Hat Product Errata RHSA-2024:2817 0 None None None 2024-05-10 19:36:55 UTC
Red Hat Product Errata RHSA-2024:2941 0 None None None 2024-05-21 09:59:03 UTC
Red Hat Product Errata RHSA-2024:3316 0 None None None 2024-05-23 06:40:28 UTC
Red Hat Product Errata RHSA-2024:3868 0 None None None 2024-06-17 00:44:40 UTC
Red Hat Product Errata RHSA-2024:3989 0 None None None 2024-06-20 00:35:17 UTC
Red Hat Product Errata RHSA-2024:4460 0 None None None 2024-07-10 15:10:51 UTC
Red Hat Product Errata RHSA-2024:4520 0 None None None 2024-07-11 17:33:01 UTC
Red Hat Product Errata RHSA-2024:4873 0 None None None 2024-07-25 15:05:01 UTC
Red Hat Product Errata RHSA-2024:6755 0 None None None 2024-09-18 11:57:35 UTC
Red Hat Product Errata RHSA-2024:7164 0 None None None 2024-09-26 03:47:53 UTC

Description Marco Benatto 2024-03-21 21:36:57 UTC
Prior to versions 7.1.0, 6.1.2, and 5.3.4, the webpack-dev-middleware development middleware for devpack does not validate the supplied URL address sufficiently before returning the local file. It is possible to access any file on the developer's machine. The middleware can either work with the physical filesystem when reading the files or it can use a virtualized in-memory `memfs` filesystem. If `writeToDisk` configuration option is set to `true`, the physical filesystem is used. The `getFilenameFromUrl` method is used to parse URL and build the local file path. The public path prefix is stripped from the URL, and the `unsecaped` path suffix is appended to the `outputPath`. As the URL is not unescaped and normalized automatically before calling the midlleware, it is possible to use `%2e` and `%2f` sequences to perform path traversal attack.

Developers using `webpack-dev-server` or `webpack-dev-middleware` are affected by the issue. When the project is started, an attacker might access any file on the developer's machine and exfiltrate the content. If the development server is listening on a public IP address (or `0.0.0.0`), an attacker on the local network can access the local files without any interaction from the victim (direct connection to the port). If the server allows access from third-party domains, an attacker can send a malicious link to the victim. When visited, the client side script can connect to the local server and exfiltrate the local files. Starting with fixed versions 7.1.0, 6.1.2, and 5.3.4, the URL is unescaped and normalized before any further processing.

https://github.com/webpack/webpack-dev-middleware/blob/7ed24e0b9f53ad1562343f9f517f0f0ad2a70377/src/utils/getFilenameFromUrl.js#L82
https://github.com/webpack/webpack-dev-middleware/blob/7ed24e0b9f53ad1562343f9f517f0f0ad2a70377/src/utils/setupOutputFileSystem.js#L21
https://github.com/webpack/webpack-dev-middleware/commit/189c4ac7d2344ec132a4689e74dc837ec5be0132
https://github.com/webpack/webpack-dev-middleware/commit/9670b3495da518fe667ff3428c5e4cb9f2f3d353
https://github.com/webpack/webpack-dev-middleware/commit/e10008c762e4d5821ed6990348dabf0d4d93a10e
https://github.com/webpack/webpack-dev-middleware/releases/tag/v5.3.4
https://github.com/webpack/webpack-dev-middleware/releases/tag/v6.1.2
https://github.com/webpack/webpack-dev-middleware/releases/tag/v7.1.0
https://github.com/webpack/webpack-dev-middleware/security/advisories/GHSA-wr3j-pwj9-hqq6

Comment 1 Marco Benatto 2024-03-21 21:40:19 UTC
Created cachelib tracking bugs for this issue:

Affects: fedora-all [bug 2270864]


Created fbthrift tracking bugs for this issue:

Affects: fedora-all [bug 2270865]


Created golang-github-prometheus tracking bugs for this issue:

Affects: epel-7 [bug 2270869]


Created h3 tracking bugs for this issue:

Affects: fedora-all [bug 2270868]


Created mozjs78 tracking bugs for this issue:

Affects: fedora-all [bug 2270866]


Created seamonkey tracking bugs for this issue:

Affects: epel-8 [bug 2270870]
Affects: fedora-all [bug 2270867]

Comment 11 errata-xmlrpc 2024-05-10 19:06:33 UTC
This issue has been addressed in the following products:

  Red Hat OpenShift GitOps 1.11

Via RHSA-2024:2815 https://access.redhat.com/errata/RHSA-2024:2815

Comment 12 errata-xmlrpc 2024-05-10 19:16:46 UTC
This issue has been addressed in the following products:

  Red Hat OpenShift GitOps 1.12

Via RHSA-2024:2816 https://access.redhat.com/errata/RHSA-2024:2816

Comment 13 errata-xmlrpc 2024-05-10 19:36:50 UTC
This issue has been addressed in the following products:

  Red Hat OpenShift GitOps 1.10

Via RHSA-2024:2817 https://access.redhat.com/errata/RHSA-2024:2817

Comment 14 errata-xmlrpc 2024-05-21 09:58:57 UTC
This issue has been addressed in the following products:

  Red Hat Advanced Cluster Security 4.4

Via RHSA-2024:2941 https://access.redhat.com/errata/RHSA-2024:2941

Comment 15 errata-xmlrpc 2024-05-23 06:40:21 UTC
This issue has been addressed in the following products:

  MTA-7.0-RHEL-9
  MTA-7.0-RHEL-8

Via RHSA-2024:3316 https://access.redhat.com/errata/RHSA-2024:3316

Comment 17 errata-xmlrpc 2024-06-17 00:44:31 UTC
This issue has been addressed in the following products:

  NETWORK-OBSERVABILITY-1.6.0-RHEL-9

Via RHSA-2024:3868 https://access.redhat.com/errata/RHSA-2024:3868

Comment 18 errata-xmlrpc 2024-06-20 00:35:10 UTC
This issue has been addressed in the following products:

  MTA-6.2-RHEL-9
  MTA-6.2-RHEL-8

Via RHSA-2024:3989 https://access.redhat.com/errata/RHSA-2024:3989

Comment 20 errata-xmlrpc 2024-06-27 11:24:33 UTC
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.16

Via RHSA-2024:0041 https://access.redhat.com/errata/RHSA-2024:0041

Comment 21 errata-xmlrpc 2024-07-10 15:10:45 UTC
This issue has been addressed in the following products:

  Red Hat Data Grid

Via RHSA-2024:4460 https://access.redhat.com/errata/RHSA-2024:4460

Comment 22 errata-xmlrpc 2024-07-11 17:32:54 UTC
This issue has been addressed in the following products:

  Red Hat Migration Toolkit for Containers 1.7

Via RHSA-2024:4520 https://access.redhat.com/errata/RHSA-2024:4520

Comment 23 errata-xmlrpc 2024-07-25 15:04:54 UTC
This issue has been addressed in the following products:

  Red Hat build of Apicurio Registry 2.6.1 GA

Via RHSA-2024:4873 https://access.redhat.com/errata/RHSA-2024:4873

Comment 24 errata-xmlrpc 2024-09-18 11:57:30 UTC
This issue has been addressed in the following products:

  RHODF-4.16-RHEL-9

Via RHSA-2024:6755 https://access.redhat.com/errata/RHSA-2024:6755

Comment 25 errata-xmlrpc 2024-09-26 03:47:46 UTC
This issue has been addressed in the following products:

  Red Hat Migration Toolkit for Containers 1.8

Via RHSA-2024:7164 https://access.redhat.com/errata/RHSA-2024:7164


Note You need to log in before you can comment on or make changes to this bug.