Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

chore(deps): update dependency @nuxt/devtools to v1.3.9 [security] #98

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

chore(deps): update dependency @nuxt/devtools to v1.3.9 [security] #98

wants to merge 1 commit into from

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Aug 6, 2024 •
edited
Loading

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
@nuxt/devtools (source) 1.0.0 -> 1.3.9 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2024-23657

Summary

Nuxt Devtools is missing authentication on the getTextAssetContent RPC function which is vulnerable to path traversal. Combined with a lack of Origin checks on the WebSocket handler, an attacker is able to interact with a locally running devtools instance and exfiltrate data abusing this vulnerability.

In certain configurations an attacker could leak the devtools authentication token and then abuse other RPC functions to achieve RCE.

Details

The getTextAssetContent function does not check for path traversals (source), this could allow an attacker to read arbitrary files over the RPC WebSocket.

The WebSocket server does not check the origin of the request (source) leading to CSWSH. This may be intentional to allow certain configurations to work correctly.

Nuxt Devtools authentication tokens are placed within the home directory of the current user (source).

In the scenario that:

  • The user has a Nuxt3 Project running
  • Devtools is enabled and running
  • The project is placed within the users home directory.
  • The user visits a malicious webpage
  • User has authenticated with devtools at least once

The malicious webpage can connect to the Devtools WebSocket, perform a directory traversal brute force to find the authentication token, then use the authenticated writeStaticAssets function to create a new Component, Nitro Handler or app.vue file which will run automatically as the file is changed.

PoC

POC will exploit the Devtools server on localhost:3000 (you may need to manually restart the server as the restart hook does not always work).

POC: https://devtools-exploit.pages.dev

  1. Create a new project with nuxt.new.
  2. Place the project inside your home directory.
  3. Run pnpm run dev.
  4. Open the POC page.

The POC will:

  • Identify devtools version.
  • Leak your devtools token.
  • Create a new server handler with an insecure eval.

Impact

  • All new Nuxt projects by default (devtools is enabled) are vulnerable to arbitrary file read.
  • Certain Nuxt configurations are vulnerable to Remote Code Execution

Release Notes

nuxt/devtools (@​nuxt/devtools)

v1.3.9

Compare Source

Bug Fixes
  • capture for circular reference in state editor (841fd76)
  • introduce client.revision to trigger state editor update (418a22e)
  • modules: update compatibility check for Nuxt 3 and 4 (#​689) (2354da7)
  • use ofetch for fast-npm-meta (4188f8d)

v1.3.8

Compare Source

Performance Improvements
  • avoid deps on npm-registry-fetch, save install size (3d74691)

v1.3.7

Compare Source

Bug Fixes
Features
Performance Improvements
  • use npm-registry-fetch instead of pacote to deduce the package size (a049c52)

v1.3.6

Compare Source

Features

v1.3.5

Compare Source

Bug Fixes
  • downgrade module-builder (de79dc4)

v1.3.4

Compare Source

Bug Fixes

v1.3.3

Compare Source

Bug Fixes

v1.3.2

Compare Source

Bug Fixes

v1.3.1

Compare Source

Bug Fixes
  • module builder chunk path patch (87199a1)

v1.3.0

Compare Source

Bug Fixes
Features

v1.2.0

Compare Source

Bug Fixes

1.1.5 (2024-03-28)

Features

1.1.4 (2024-03-26)

Bug Fixes

1.1.3 (2024-03-21)

Bug Fixes

1.1.2 (2024-03-21)

Bug Fixes
Features

1.1.1 (2024-03-20)

Bug Fixes

v1.1.5

Compare Source

Features

v1.1.4

Compare Source

Bug Fixes

v1.1.3

Compare Source

Bug Fixes

v1.1.2

Compare Source

Bug Fixes
Features

v1.1.1

Compare Source

Bug Fixes

v1.1.0

Compare Source

Bug Fixes
Features

1.0.8 (2024-01-11)

Bug Fixes

1.0.7 (2024-01-11)

Bug Fixes
  • devtools: update default types to module.d.ts/.mts (#​559) (2ecd32c)
  • make twitter og tags optional (41ee5ec)
  • open-graph: fix type error, close #​563 (c63055a)
  • support iframeProps option for CSP, fix Stackblitz (0eb7a82)
  • timeline-helper-wrapper: Fix return value in timeline wrapper for promises (#​567) (0645e35)
  • update title of Eye Dropper command (#​558) (ea58139)
Features
  • server-routes: implement persisting input values in localStorage (#​545) (67dbf65)

1.0.6 (2023-12-13)

Bug Fixes

1.0.5 (2023-12-07)

Bug Fixes
  • allow iframe to work in stricter cross-origin policy (7ec0d3c)
  • devtools: don't enable devtools when in test mode (#​532) (3a7f143)
Features

1.0.4 (2023-11-27)

Bug Fixes
  • pip: check for https support (#​522) (5360cf4)
  • require auth token with getImageMeta and getTextAssetContent (69316c4)
  • require token for restartNuxt (09384af)
Features

1.0.3 (2023-11-20)

Bug Fixes
Features
  • disable devtools in test mode (51e8de6)

1.0.2 (2023-11-11)

Bug Fixes
  • do not show false connecting overlay on legacy Vite, close #​497 (a48c248)
  • timeline: do not inject for macro module, close #​507 (923edaf)

1.0.1 (2023-11-09)

Bug Fixes

v1.0.8

Compare Source

Bug Fixes

v1.0.7

Compare Source

Bug Fixes
  • devtools: update default types to module.d.ts/.mts (#​559) (2ecd32c)
  • make twitter og tags optional (41ee5ec)
  • open-graph: fix type error, close #​563 (c63055a)
  • support iframeProps option for CSP, fix Stackblitz (0eb7a82)
  • timeline-helper-wrapper: Fix return value in timeline wrapper for promises (#​567) (0645e35)
  • update title of Eye Dropper command (#​558) (ea58139)
Features
  • server-routes: implement persisting input values in localStorage (#​545) (67dbf65)

v1.0.6

Compare Source

Bug Fixes

v1.0.5

Compare Source

Bug Fixes
  • allow iframe to work in stricter cross-origin policy (7ec0d3c)
  • devtools: don't enable devtools when in test mode (#​532) (3a7f143)
Features

v1.0.4

Compare Source

Bug Fixes
  • pip: check for https support (#​522) (5360cf4)
  • require auth token with getImageMeta and getTextAssetContent (69316c4)
  • require token for restartNuxt (09384af)
Features

v1.0.3

Compare Source

Bug Fixes
Features
  • disable devtools in test mode (51e8de6)

v1.0.2

Compare Source

Bug Fixes
  • do not show false connecting overlay on legacy Vite, close #​497 (a48c248)
  • timeline: do not inject for macro module, close #​507 (923edaf)

v1.0.1

Compare Source

Bug Fixes

Configuration

📅 Schedule: Branch creation - "" in timezone Pacific/Auckland, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate Renovate
Copy link
Contributor Author

renovate bot commented Aug 6, 2024

Branch automerge failure

This PR was configured for branch automerge. However, this is not possible, so it has been raised as a PR instead.

  • Branch has one or more failed status checks

@renovate renovate bot assigned svglol Aug 6, 2024
@vercel Vercel
Copy link

vercel bot commented Aug 6, 2024 •
edited
Loading

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name Status Preview Comments Updated (UTC)
discord-timestamp-generator ❌ Failed (Inspect) Nov 12, 2024 3:24am

@renovate renovate bot force-pushed the renovate/npm-nuxt-devtools-vulnerability branch from fabacff to bc9f650 Compare August 8, 2024 19:20
@renovate renovate bot force-pushed the renovate/npm-nuxt-devtools-vulnerability branch from bc9f650 to 9eadb93 Compare August 8, 2024 23:35
@renovate renovate bot force-pushed the renovate/npm-nuxt-devtools-vulnerability branch from 9eadb93 to 056a488 Compare August 9, 2024 22:20
@renovate renovate bot force-pushed the renovate/npm-nuxt-devtools-vulnerability branch from 056a488 to c9c9c63 Compare August 13, 2024 11:47
@renovate renovate bot force-pushed the renovate/npm-nuxt-devtools-vulnerability branch from c9c9c63 to d0ea63d Compare August 16, 2024 21:22
@renovate renovate bot force-pushed the renovate/npm-nuxt-devtools-vulnerability branch from d0ea63d to 8eed2bc Compare August 18, 2024 13:18
@renovate renovate bot force-pushed the renovate/npm-nuxt-devtools-vulnerability branch from 8eed2bc to 9ab9e9e Compare August 19, 2024 08:10
@renovate renovate bot force-pushed the renovate/npm-nuxt-devtools-vulnerability branch from 9ab9e9e to 9e0a0bc Compare August 19, 2024 17:21
@renovate renovate bot force-pushed the renovate/npm-nuxt-devtools-vulnerability branch from 9e0a0bc to 2c6dd54 Compare August 22, 2024 22:45
@renovate renovate bot force-pushed the renovate/npm-nuxt-devtools-vulnerability branch from 2c6dd54 to 3ddc829 Compare August 27, 2024 06:30
@renovate renovate bot force-pushed the renovate/npm-nuxt-devtools-vulnerability branch from 3ddc829 to 174a20d Compare August 28, 2024 03:39
@renovate renovate bot force-pushed the renovate/npm-nuxt-devtools-vulnerability branch from 174a20d to 0937973 Compare August 29, 2024 22:41
@renovate renovate bot force-pushed the renovate/npm-nuxt-devtools-vulnerability branch from 0937973 to 0c34b24 Compare September 1, 2024 15:25
@renovate renovate bot force-pushed the renovate/npm-nuxt-devtools-vulnerability branch from e8b5ce0 to f403a25 Compare October 19, 2024 10:36
@renovate renovate bot force-pushed the renovate/npm-nuxt-devtools-vulnerability branch from f403a25 to b9c8988 Compare October 20, 2024 22:58
@renovate renovate bot force-pushed the renovate/npm-nuxt-devtools-vulnerability branch from b9c8988 to a9a2484 Compare October 22, 2024 06:19
@renovate renovate bot force-pushed the renovate/npm-nuxt-devtools-vulnerability branch from a9a2484 to 3ef629e Compare October 23, 2024 11:09
@renovate renovate bot force-pushed the renovate/npm-nuxt-devtools-vulnerability branch from 3ef629e to 1cd4889 Compare October 23, 2024 18:56
@renovate renovate bot force-pushed the renovate/npm-nuxt-devtools-vulnerability branch from 1cd4889 to 2b33be2 Compare October 25, 2024 17:22
@renovate renovate bot force-pushed the renovate/npm-nuxt-devtools-vulnerability branch from 2b33be2 to 78f94c6 Compare October 28, 2024 17:16
@renovate renovate bot force-pushed the renovate/npm-nuxt-devtools-vulnerability branch from 78f94c6 to a8ab62c Compare October 28, 2024 19:45
@renovate renovate bot force-pushed the renovate/npm-nuxt-devtools-vulnerability branch from a8ab62c to e48bea9 Compare October 29, 2024 02:16
@renovate renovate bot force-pushed the renovate/npm-nuxt-devtools-vulnerability branch from e48bea9 to 8a9bcbc Compare October 29, 2024 21:30
@renovate renovate bot force-pushed the renovate/npm-nuxt-devtools-vulnerability branch from 8a9bcbc to 2c7c04b Compare October 31, 2024 10:27
@renovate renovate bot force-pushed the renovate/npm-nuxt-devtools-vulnerability branch from 2c7c04b to 9070b11 Compare October 31, 2024 23:36
@renovate renovate bot force-pushed the renovate/npm-nuxt-devtools-vulnerability branch from 9070b11 to a5e2ef8 Compare November 3, 2024 10:49
@renovate renovate bot force-pushed the renovate/npm-nuxt-devtools-vulnerability branch from a5e2ef8 to d0b554f Compare November 12, 2024 03:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees

@svglol svglol

Labels
chore dependencies
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@svglol