Directory TraversalAffected versions of this package are vulnerable to Directory Traversal through getFilenameFromUrl in src/middleware.js. An attacker can read files outside the configured output directory by sending a request whose path shares a publicPath prefix without actually being under it, such as /static../secret.txt when publicPath is /static. When the middleware joins that stripped path to outputPath, the request resolves above the served root and returns the targeted file contents instead of rejecting the request. Applications exposing webpack-dev-middleware, directly or through webpack-dev-server, with a non-slash-terminated publicPath are affected.
Workarounds
- Configure
publicPath with a trailing slash, for example /assets/ instead of /assets, to prevent requests like /assets../secret from being treated as if they were under the served prefix and escaping the output directory.
How to fix Directory Traversal? Upgrade webpack-dev-middleware to version 7.4.6, 8.3.0 or higher.
| |
Path TraversalAffected versions of this package are vulnerable to Path Traversal due to insufficient validation of the supplied URL address before returning the local file. This issue allows accessing any file on the developer's machine. The middleware can operate with either the physical filesystem or a virtualized in-memory memfs filesystem. When the writeToDisk configuration option is set to true, the physical filesystem is utilized. The getFilenameFromUrl method parses the URL and constructs the local file path by stripping the public path prefix from the URL and appending the unescaped path suffix to the outputPath. Since the URL is not unescaped and normalized automatically before calling the middleware, it is possible to use %2e and %2f sequences to perform a path traversal attack.
Notes:
This vulnerability is exploitable without any specific configurations, allowing an attacker to access and exfiltrate content from any file on the developer's machine.
If the development server is exposed on a public IP address or 0.0.0.0, an attacker on the local network can access the files without victim interaction.
If the server permits access from third-party domains, a malicious link could lead to local file exfiltration when visited by the victim.
How to fix Path Traversal? Upgrade webpack-dev-middleware to version 5.3.4, 6.1.2, 7.1.0 or higher.
| <5.3.4>=6.0.0 <6.1.2>=7.0.0 <7.1.0 |
