CVE-2018-14732: webpack.js webpack-dev-server Improper Input Validation
Vulnerability summary
CVE-2018-14732 is a high (CVSS 7.5) Improper Input Validation vulnerability in webpack.js webpack-dev-server. EPSS estimates a 2.56% chance of exploitation in the next 30 days, higher than 84.8% of scored vulnerabilities. 2 public exploits are recorded.
Timeline
- 21-09-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
An issue was discovered in lib/Server.js in webpack-dev-server before 3.1.6. Attackers are able to steal developer's code because the origin of requests is not checked by the WebSocket server, which is used for HMR (Hot Module Replacement). Anyone can receive the HMR message sent by the WebSocket server via a ws://127.0.0.1:8080/ connection from any origin.
CVSS metrics
3 scores · 2 sources · 2 versions- OSV · NpmEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
2.56%
Chance of exploitation in the next 30 days
Percentile
85%
Versus all other CVEs
30-day change
0.00 pp
From 2.56% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundWebpack Dev Server
Maturity: poc
Exploit Reference (blog.cal1.cn)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Npm1 product
- webpack-dev-server< 3.1.11
Webpack.js1 product
- webpack-dev-server< 3.1.6
2 vendors · 2 products
References
8 links- blog.cal1.cn/post/Sniffing%20Codes%20in%20Hot%20Module%20Reloading%20MessagesX Refsource MISCExploitThird Party Advisory
- github.com/webpack/webpack-dev-server/commit/f18e5adf123221a1015be63e1ca2491ca45b8d10X Refsource CONFIRMPatchThird Party AdvisoryWEB
