CVE-2018-14730

Vulnerability

Browserify-HMR, a Hot Module Replacement plugin for Browserify, includes a WebSocket server on ws://127.0.0.1:3123/ that does not validate the Origin header of incoming connections [1][2]. This allows any website or attacker to establish a WebSocket connection to the server. The issue affects Browserify-HMR versions prior to any fix released after the disclosure.

Exploitation

An attacker with network access to the developer's machine (e.g., by tricking the developer into visiting a malicious webpage) can connect to the WebSocket server at ws://127.0.0.1:3123/ from any origin. The server sends HMR messages containing updated source code to all connected clients, and the attacker passively receives them without any additional interaction.

Impact

Successful exploitation results in unauthorized disclosure of the developer's source code as it is modified in real-time. The attacker gains access to proprietary or sensitive code, leading to information disclosure. No write access or remote code execution is achieved.

Mitigation

As of the available references, no patched version has been announced [1][2]. Users should restrict access to the WebSocket server by ensuring the development environment is not exposed to untrusted networks, or implement a reverse proxy that validates the Origin header. Alternatively, developers can disable Hot Module Replacement on untrusted networks.