[AppSecAI Agent] webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints

[conviso-platform-appsec-staging]

AppSecAI Agent

Issue ID: 1713858
Title: webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints
Severity: MEDIUM
Type: ScaFinding

Description

Impact

The internal /webpack-dev-server/open-editor and /webpack-dev-server/invalidate endpoints perform state-changing actions on any GET request, without verifying that the request originated from the dev server's own page. Any website a developer visits while the dev server is running can trigger them cross-origin with no interaction beyond the visit.

An attacker can open an arbitrary existing local file in the developer's editor, including files outside the project root (e.g. ~/.ssh/config). The file's contents are not returned to the attacker. Repeated requests can also spawn editor processes and force recompilations, degrading the developer's machine.

Patches

Fixed in webpack-dev-server 5.2.6 by rejecting cross-site requests to the /webpack-dev-server/open-editor and /webpack-dev-server/invalidate endpoints (see PR #5698).

Workarounds

None

Fix Details

Security Fix: Upgrade webpack-dev-server to resolve CSRF vulnerability

Summary

This PR addresses a medium-severity security vulnerability in webpack-dev-server (CVE affecting versions prior to 5.2.6) by adding a resolution to enforce the use of a patched version.

Vulnerability Details

• Type: Cross-Site Request Forgery (CSRF)
• Package: webpack-dev-server
• Affected Version: < 5.2.6
• Patched Version: >= 5.2.6
• Severity: MEDIUM

Description

The internal /webpack-dev-server/open-editor and /webpack-dev-server/invalidate endpoints in webpack-dev-server performed state-changing actions on any GET request without verifying that the request originated from the dev server's own page. This allowed any website a developer visits while the dev server is running to trigger these endpoints cross-origin with no interaction beyond the visit.

Impact:

• An attacker could open arbitrary existing local files in the developer's editor, including files outside the project root (e.g., ~/.ssh/config)
• Repeated requests could spawn editor processes and force recompilations, degrading the developer's machine performance

Fix

Added "webpack-dev-server": ">=5.2.6" to the resolutions field in package.json. This ensures that any transitive dependency on webpack-dev-server (pulled in via @docusaurus/core or other packages) will use version 5.2.6 or later, which rejects cross-site requests to the vulnerable endpoints.

The fix in webpack-dev-server 5.2.6 (PR #5698) adds origin validation to reject cross-site requests to the /webpack-dev-server/open-editor and /webpack-dev-server/invalidate endpoints.

---

This PR was automatically created by Conviso Platform Auto-Fix.

[conviso-platform-appsec]

Conviso Security Gate — No Security Gate rule configured

No conviso_ast rule and no default rule are configured for this asset or company, so there is no policy to evaluate. Nothing was passed or failed.

No new findings were introduced by this pull request.

View the full run in Conviso