Nuxt Devtools Vulnerability Allows Path Traversal and RCE

CVE-2024-23657

Summary

The Nuxt Devtools framework, part of the Nuxt ecosystem for developing web applications with Vue.js, faces a significant vulnerability due to insufficient authentication and checks in the RPC functions. The getTextAssetContent function's lack of path traversal validation allows attackers to read arbitrary files via the RPC WebSocket. Additionally, the absence of Origin checks on the WebSocket server opens doors for cross-site WebSocket hijacking, enabling unauthorized access. Attackers can thus exploit these vulnerabilities to interact with a local devtools instance, potentially exfiltrating sensitive data and leveraging obtained authentication tokens to implement remote code execution. Users are strongly advised to upgrade to version 1.3.9, which addresses these security issues, as there are no workarounds available.

References