EIQ-2019-0004

EIQ-2019-0004

CVE-2018-14732

No origin validation in webpack-dev-server

30 Jan 2019

3 - HIGH

7.5

2.3.4

webpack-dev-server versions 3.1.10 and earlier fail to correctly check the origin of the requests sent to the WebSocket server component.

This makes it possible for a remote attacker to send a Hot Module Replacement (HMR) message to a targeted system.
In this way, the the attacker can obtain access to sensitive information on the targeted system.

• Update to webpack-dev-server 3.1.11 or later.

• Restrict network access to block untrusted sources.

2.3.0 to 2.3.3 included.

For more information, see:

• npm advisory

• A vulnerability found in webpack-dev-server

• check origin header for websocket connection

• Sniffing Codes in Hot Module Reloading Messages