Arbitrary File Read Affecting wrangler package, versions >=3.9.0 <3.18.0
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-WRANGLER-6140498
- published 31 Dec 2023
- disclosed 29 Dec 2023
- credit Lekensteyn
Introduced: 29 Dec 2023
CVE-2023-7079 Open this link in a new tabHow to fix?
Upgrade wrangler to version 3.18.0 or higher.
Overview
wrangler is a Command-line interface for all things Cloudflare Workers
Affected versions of this package are vulnerable to Arbitrary File Read by specially crafted HTTP requests and inspector messages to the dev server. An attacker can access any file on the user's computer over the local network by convincing a user to open a malicious website.
Workaround
This vulnerability can be mitigated by configuring Wrangler to listen on local interfaces instead with wrangler dev --ip 127.0.0.1. This does not prevent the visiting of a malicious website.