Snyk Security Database

webpack-dev-server is an Uses webpack with a development server that provides live reloading. It should be used for development only.

Affected versions of this package are vulnerable to Origin Validation Error via the WebSocket upgrade handler in lib/Server.js when a devServer.proxy entry is configured with ws: true. Upgrade requests are dispatched directly from the raw HTTP server and never enter the middleware chain, so allowedHosts and the cross-origin checks do not run for proxied WebSocket connections. An attacker can serve a cross-origin page that opens a WebSocket connection through the dev server proxy to a backend service the developer has configured, bypassing the Host and Origin header validation that protects the HMR socket.

Note: This is only exploitable when a devServer.proxy entry is configured with ws: true.

1h1 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship.

Affected versions of this package are vulnerable to Directory Traversal via the RemoteFileConsumer in its FTP-family remote-file components. An attacker who can cause a server to report a listing name containing parent-directory segments can make Camel retrieve files outside the configured polling directory, exposing their contents through the endpoint’s credentials; deletion or renaming also becomes possible when the corresponding options are enabled. A malicious or compromised server can supply such names, and an on-path attacker can rewrite FTP listings; retrieval is enabled by default. The SmbConsumer has the same unchecked path construction, but exploiting it requires an SMB server to emit a name that is not a single path segment; conforming SMB2 implementations do not do so, and the advisory reports no demonstrated exploit for that scheme.

Notes

• On the SMB listing-to-path step, exploitation requires the server to emit a name that is not a single path segment; a conforming SMB2 implementation does not do this.
• The escaped remote operation reaches outside Camel’s polling directory, but access beyond the server account’s own boundary depends on whether that account is confined.