chore(deps): update devdependency @nuxt/devtools to v1 [security] #194
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
Deploying authjs-nuxt with
|
| Latest commit: |
0f98af8
|
| Status: | 🚫 Build failed. |
renovate
bot
force-pushed
the
renovate/npm-nuxt-devtools-vulnerability
branch
2 times, most recently
from
309238b to
40c27c0
Compare
renovate
bot
force-pushed
the
renovate/npm-nuxt-devtools-vulnerability
branch
2 times, most recently
from
ce5e4a9 to
5c3194b
Compare
renovate
bot
force-pushed
the
renovate/npm-nuxt-devtools-vulnerability
branch
from
5c3194b to
a355e07
Compare
|
renovate
bot
force-pushed
the
renovate/npm-nuxt-devtools-vulnerability
branch
from
a355e07 to
126cd9a
Compare
renovate
bot
changed the title
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/npm-nuxt-devtools-vulnerability
branch
3 times, most recently
from
98e8a2c to
d642886
Compare
renovate
bot
force-pushed
the
renovate/npm-nuxt-devtools-vulnerability
branch
3 times, most recently
from
1ee0696 to
1fbfb22
Compare
renovate
bot
force-pushed
the
renovate/npm-nuxt-devtools-vulnerability
branch
from
1fbfb22 to
0f98af8
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
^0.8.5->^1.3.9GitHub Vulnerability Alerts
CVE-2024-23657
Summary
Nuxt Devtools is missing authentication on the
getTextAssetContentRPC function which is vulnerable to path traversal. Combined with a lack of Origin checks on the WebSocket handler, an attacker is able to interact with a locally running devtools instance and exfiltrate data abusing this vulnerability.In certain configurations an attacker could leak the devtools authentication token and then abuse other RPC functions to achieve RCE.
Details
The
getTextAssetContentfunction does not check for path traversals (source), this could allow an attacker to read arbitrary files over the RPC WebSocket.The WebSocket server does not check the origin of the request (source) leading to CSWSH. This may be intentional to allow certain configurations to work correctly.
Nuxt Devtools authentication tokens are placed within the home directory of the current user (source).
In the scenario that:
The malicious webpage can connect to the Devtools WebSocket, perform a directory traversal brute force to find the authentication token, then use the authenticated
writeStaticAssetsfunction to create a new Component, Nitro Handler orapp.vuefile which will run automatically as the file is changed.PoC
POC will exploit the Devtools server on localhost:3000 (you may need to manually restart the server as the restart hook does not always work).
POC: https://devtools-exploit.pages.dev
pnpm run dev.The POC will:
Impact
Release Notes
nuxt/devtools (@nuxt/devtools)
v1.3.9Compare Source
Bug Fixes
client.revisionto trigger state editor update (418a22e)ofetchforfast-npm-meta(4188f8d)v1.3.8Compare Source
Performance Improvements
npm-registry-fetch, save install size (3d74691)v1.3.7Compare Source
Bug Fixes
Features
Performance Improvements
npm-registry-fetchinstead ofpacoteto deduce the package size (a049c52)v1.3.6Compare Source
Features
v1.3.5Compare Source
Bug Fixes
v1.3.4Compare Source
Bug Fixes
v1.3.3Compare Source
Bug Fixes
@vue/devtools-*(4c79fac)v1.3.2Compare Source
Bug Fixes
v1.3.1Compare Source
Bug Fixes
v1.3.0Compare Source
Bug Fixes
vite-plugin-vue-inspector, fix #657 (f67f0f2)Features
v1.2.0Compare Source
Bug Fixes
builder:watch(#637) (800d71f)import.meta.*properties (#635) (ce60ab4)1.1.5 (2024-03-28)
Features
@vue/devtools-applet, fix #640 (cbb711d)1.1.4 (2024-03-26)
Bug Fixes
1.1.3 (2024-03-21)
Bug Fixes
1.1.2 (2024-03-21)
Bug Fixes
Features
1.1.1 (2024-03-20)
Bug Fixes
v1.1.5Compare Source
Features
@vue/devtools-applet, fix #640 (cbb711d)v1.1.4Compare Source
Bug Fixes
v1.1.3Compare Source
Bug Fixes
v1.1.2Compare Source
Bug Fixes
Features
v1.1.1Compare Source
Bug Fixes
v1.1.0Compare Source
Bug Fixes
tsxdependency to known fixed version (broken on Node v18.19.0+) (#606) (1bc2e71)syncClient(#584) (9a2dbc2)to. (#581) (12dae59)Features
1.0.8 (2024-01-11)
Bug Fixes
1.0.7 (2024-01-11)
Bug Fixes
module.d.ts/.mts(#559) (2ecd32c)iframePropsoption for CSP, fix Stackblitz (0eb7a82)Features
1.0.6 (2023-12-13)
Bug Fixes
1.0.5 (2023-12-07)
Bug Fixes
Features
1.0.4 (2023-11-27)
Bug Fixes
getImageMetaandgetTextAssetContent(69316c4)restartNuxt(09384af)Features
1.0.3 (2023-11-20)
Bug Fixes
baseURL, close #506 (2697340)Features
1.0.2 (2023-11-11)
Bug Fixes
1.0.1 (2023-11-09)
Bug Fixes
#imports(#500) (68efb1b)v1.0.8Compare Source
Bug Fixes
v1.0.7Compare Source
Bug Fixes
module.d.ts/.mts(#559) (2ecd32c)iframePropsoption for CSP, fix Stackblitz (0eb7a82)Features
v1.0.6Compare Source
Bug Fixes
v1.0.5Compare Source
Bug Fixes
Features
v1.0.4Compare Source
Bug Fixes
getImageMetaandgetTextAssetContent(69316c4)restartNuxt(09384af)Features
v1.0.3Compare Source
Bug Fixes
baseURL, close #506 (2697340)Features
v1.0.2Compare Source
Bug Fixes
v1.0.1Compare Source
Bug Fixes
#imports(#500) (68efb1b)v1.0.0Compare Source
Features
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.