Arbitrary remote code execution within wrangler dev Workers sandbox

CVE-2023-7080

What is CVE-2023-7080?

The Cloudflare Workers V8 Inspector allows arbitrary code execution within the Workers sandbox when used for debugging. An improperly configured inspector server can be accessed by attackers on the local network, who can exploit this by tricking users into opening a malicious site. This vulnerability occurs due to a lack of Origin/Host header validation and has been addressed in wrangler versions 3.19.0 and 2.20.2. Prior versions allow attackers to potentially access production resources if remote development commands are used.

References