webpack-dev-middleware@3.6.2 vulnerabilities

Affected versions of this package are vulnerable to Path Traversal due to insufficient validation of the supplied URL address before returning the local file. This issue allows accessing any file on the developer's machine. The middleware can operate with either the physical filesystem or a virtualized in-memory memfs filesystem. When the writeToDisk configuration option is set to true, the physical filesystem is utilized. The getFilenameFromUrl method parses the URL and constructs the local file path by stripping the public path prefix from the URL and appending the unescaped path suffix to the outputPath. Since the URL is not unescaped and normalized automatically before calling the middleware, it is possible to use %2e and %2f sequences to perform a path traversal attack.

Notes:

1. This vulnerability is exploitable without any specific configurations, allowing an attacker to access and exfiltrate content from any file on the developer's machine.

2. If the development server is exposed on a public IP address or 0.0.0.0, an attacker on the local network can access the files without victim interaction.

3. If the server permits access from third-party domains, a malicious link could lead to local file exfiltration when visited by the victim.

Upgrade webpack-dev-middleware to version 5.3.4, 6.1.2, 7.1.0 or higher.