🚨 [security] Update webpack-dev-server 4.15.2 → 5.2.0 (major)

[depfu]

---

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

---

Here is everything you need to know about this upgrade. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ webpack-dev-server (4.15.2 → 5.2.0) · Repo · Changelog

Release Notes

5.2.0

More info than we can show here.

5.1.0

More info than we can show here.

5.0.4

More info than we can show here.

5.0.3

More info than we can show here.

5.0.2

More info than we can show here.

5.0.1

More info than we can show here.

5.0.0

More info than we can show here.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ @​types/http-proxy (indirect, 1.17.14 → 1.17.16) · Repo

Sorry, we couldn't find anything useful about this release.

↗️ @​types/retry (indirect, 0.12.0 → 0.12.2) · Repo

Sorry, we couldn't find anything useful about this release.

↗️ body-parser (indirect, 1.20.2 → 1.20.3) · Repo · Changelog

Security Advisories 🚨

🚨 body-parser vulnerable to denial of service when url encoding is enabled

Impact

body-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service.

Patches

this issue is patched in 1.20.3

References

Release Notes

1.20.3

More info than we can show here.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ cookie (indirect, 0.6.0 → 0.7.1) · Repo · Changelog

Security Advisories 🚨

🚨 cookie accepts cookie name, path, and domain with out of bounds characters

Impact

The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. For example, serialize("userName=<script>alert('XSS3')</script>; Max-Age=2592000; a", value) would result in "userName=<script>alert('XSS3')</script>; Max-Age=2592000; a=test", setting userName cookie to <script> and ignoring value.

A similar escape can be used for path and domain, which could be abused to alter other fields of the cookie.

Patches

Upgrade to 0.7.0, which updates the validation for name, path, and domain.

Workarounds

Avoid passing untrusted or arbitrary values for these fields, ensure they are set by the application instead of user input.

References

• #167

Release Notes

0.7.1

More info than we can show here.

0.7.0

More info than we can show here.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ express (indirect, 4.19.2 → 4.21.2) · Repo · Changelog

Security Advisories 🚨

🚨 express vulnerable to XSS via response.redirect()

Impact

In express <4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code

Patches

this issue is patched in express 4.20.0

Workarounds

users are encouraged to upgrade to the patched version of express, but otherwise can workaround this issue by making sure any untrusted inputs are safe, ideally by validating them against an explicit allowlist

Details

successful exploitation of this vector requires the following:

1. The attacker MUST control the input to response.redirect()
2. express MUST NOT redirect before the template appears
3. the browser MUST NOT complete redirection before:
4. the user MUST click on the link in the template

Release Notes

4.21.2

More info than we can show here.

4.21.1

More info than we can show here.

4.21.0

More info than we can show here.

4.20.0

More info than we can show here.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ finalhandler (indirect, 1.2.0 → 1.3.1) · Repo · Changelog

Release Notes

1.2.1 (from changelog)

More info than we can show here.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ follow-redirects (indirect, 1.15.6 → 1.15.9) · Repo

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ http-proxy-middleware (indirect, 2.0.6 → 2.0.7) · Repo · Changelog

Security Advisories 🚨

🚨 Denial of service in http-proxy-middleware

Versions of the package http-proxy-middleware before 2.0.7, from 3.0.0 and before 3.0.3 are vulnerable to Denial of Service (DoS) due to an UnhandledPromiseRejection error thrown by micromatch. An attacker could kill the Node.js process and crash the server by making requests to certain paths.

Release Notes

2.0.7

More info than we can show here.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ is-docker (indirect, 2.2.1 → 3.0.0) · Repo

Release Notes

3.0.0

More info than we can show here.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ is-wsl (indirect, 2.2.0 → 3.1.0) · Repo

Release Notes

3.1.0

More info than we can show here.

3.0.0

More info than we can show here.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ merge-descriptors (indirect, 1.0.1 → 1.0.3) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ open (indirect, 8.4.2 → 10.1.0) · Repo

Release Notes

10.1.0

More info than we can show here.

10.0.4

More info than we can show here.

10.0.3

More info than we can show here.

10.0.2

More info than we can show here.

10.0.1

More info than we can show here.

10.0.0

More info than we can show here.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ p-retry (indirect, 4.6.2 → 6.2.1) · Repo

Release Notes

6.2.1

More info than we can show here.

6.2.0

More info than we can show here.

6.1.0

More info than we can show here.

6.0.0

More info than we can show here.

5.1.2

More info than we can show here.

5.1.1

More info than we can show here.

5.1.0

More info than we can show here.

5.0.0

More info than we can show here.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ path-to-regexp (indirect, 0.1.7 → 0.1.12) · Repo · Changelog

Security Advisories 🚨

🚨 Unpatched `path-to-regexp` ReDoS in 0.1.x

Impact

The regular expression that is vulnerable to backtracking can be generated in the 0.1.x release of path-to-regexp, originally reported in CVE-2024-45296

Patches

Upgrade to 0.1.12.

Workarounds

Avoid using two parameters within a single path segment, when the separator is not . (e.g. no /:a-:b). Alternatively, you can define the regex used for both parameters and ensure they do not overlap to allow backtracking.

References

• GHSA-9wv6-86v2-598j
• https://blakeembrey.com/posts/2024-09-web-redos/

🚨 path-to-regexp outputs backtracking regular expressions

Impact

A bad regular expression is generated any time you have two parameters within a single segment, separated by something that is not a period (.). For example, /:a-:b.

Patches

For users of 0.1, upgrade to 0.1.10. All other users should upgrade to 8.0.0.

These versions add backtrack protection when a custom regex pattern is not provided:

• 0.1.10
• 1.9.0
• 3.3.0
• 6.3.0

They do not protect against vulnerable user supplied capture groups. Protecting against explicit user patterns is out of scope for old versions and not considered a vulnerability.

Version 7.1.0 can enable strict: true and get an error when the regular expression might be bad.

Version 8.0.0 removes the features that can cause a ReDoS.

Workarounds

All versions can be patched by providing a custom regular expression for parameters after the first in a single segment. As long as the custom regular expression does not match the text before the parameter, you will be safe. For example, change /:a-:b to /:a-:b([^-/]+).

If paths cannot be rewritten and versions cannot be upgraded, another alternative is to limit the URL length. For example, halving the attack string improves performance by 4x faster.

Details

Using /:a-:b will produce the regular expression /^\/([^\/]+?)-([^\/]+?)\/?$/. This can be exploited by a path such as /a${'-a'.repeat(8_000)}/a. OWASP has a good example of why this occurs, but the TL;DR is the /a at the end ensures this route would never match but due to naive backtracking it will still attempt every combination of the :a-:b on the repeated 8,000 -a.

Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event loop and can lead to a DoS. In local benchmarks, exploiting the unsafe regex will result in performance that is over 1000x worse than the safe regex. In a more realistic environment using Express v4 and 10 concurrent connections, this translated to average latency of ~600ms vs 1ms.

References

• OWASP
• Detailed blog post

Release Notes

0.1.12

More info than we can show here.

0.1.10

More info than we can show here.

0.1.9

More info than we can show here.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ qs (indirect, 6.11.0 → 6.13.0) · Repo · Changelog

Release Notes

6.13.0 (from changelog)

More info than we can show here.

6.12.3 (from changelog)

More info than we can show here.

6.12.2 (from changelog)

More info than we can show here.

6.11.2 (from changelog)

More info than we can show here.

6.11.1 (from changelog)

More info than we can show here.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ send (indirect, 0.18.0 → 0.19.0) · Repo · Changelog

Security Advisories 🚨

🚨 send vulnerable to template injection that can lead to XSS

Impact

passing untrusted user input - even after sanitizing it - to SendStream.redirect() may execute untrusted code

Patches

this issue is patched in send 0.19.0

Workarounds

users are encouraged to upgrade to the patched version of express, but otherwise can workaround this issue by making sure any untrusted inputs are safe, ideally by validating them against an explicit allowlist

Details

successful exploitation of this vector requires the following:

1. The attacker MUST control the input to response.redirect()
2. express MUST NOT redirect before the template appears
3. the browser MUST NOT complete redirection before:
4. the user MUST click on the link in the template

Release Notes

0.19.0

More info than we can show here.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ serve-static (indirect, 1.15.0 → 1.16.2) · Repo · Changelog

Security Advisories 🚨

🚨 serve-static vulnerable to template injection that can lead to XSS

Impact

passing untrusted user input - even after sanitizing it - to redirect() may execute untrusted code

Patches

this issue is patched in serve-static 1.16.0

Workarounds

users are encouraged to upgrade to the patched version of express, but otherwise can workaround this issue by making sure any untrusted inputs are safe, ideally by validating them against an explicit allowlist

Details

successful exploitation of this vector requires the following:

1. The attacker MUST control the input to response.redirect()
2. express MUST NOT redirect before the template appears
3. the browser MUST NOT complete redirection before:
4. the user MUST click on the link in the template

Release Notes

1.16.0

More info than we can show here.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ webpack-dev-middleware (indirect, 5.3.4 → 7.4.2) · Repo · Changelog

Security Advisories 🚨

🚨 Path traversal in webpack-dev-middleware

Summary

The webpack-dev-middleware middleware does not validate the supplied URL address sufficiently before returning the local file. It is possible to access any file on the developer's machine.

Details

The middleware can either work with the physical filesystem when reading the files or it can use a virtualized in-memory memfs filesystem.
If writeToDisk configuration option is set to true, the physical filesystem is used:

webpack-dev-middleware/src/utils/setupOutputFileSystem.js

Line 21 in 7ed24e0

    <tbody>

else if (context.options.writeToDisk !== true) {

The getFilenameFromUrl method is used to parse URL and build the local file path.
The public path prefix is stripped from the URL, and the unsecaped path suffix is appended to the outputPath:

webpack-dev-middleware/src/utils/getFilenameFromUrl.js

Line 82 in 7ed24e0

    <tbody>

if (

As the URL is not unescaped and normalized automatically before calling the midlleware, it is possible to use %2e and %2f sequences to perform path traversal attack.

PoC

A blank project can be created containing the following configuration file webpack.config.js:
module.exports = { devServer: { devMiddleware: { writeToDisk: true } } };

When started, it is possible to access any local file, e.g. /etc/passwd:
$ curl localhost:8080/public/..%2f..%2f..%2f..%2f../etc/passwd

root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin

Impact

The developers using webpack-dev-server or webpack-dev-middleware are affected by the issue. When the project is started, an attacker might access any file on the developer's machine and exfiltrate the content (e.g. password, configuration files, private source code, ...).

If the development server is listening on a public IP address (or 0.0.0.0), an attacker on the local network can access the local files without any interaction from the victim (direct connection to the port).

If the server allows access from third-party domains (CORS, Allow-Access-Origin: * ), an attacker can send a malicious link to the victim. When visited, the client side script can connect to the local server and exfiltrate the local files.

Recommendation

The URL should be unescaped and normalized before any further processing.

🚨 Path traversal in webpack-dev-middleware

Summary

The webpack-dev-middleware middleware does not validate the supplied URL address sufficiently before returning the local file. It is possible to access any file on the developer's machine.

Details

The middleware can either work with the physical filesystem when reading the files or it can use a virtualized in-memory memfs filesystem.
If writeToDisk configuration option is set to true, the physical filesystem is used:

webpack-dev-middleware/src/utils/setupOutputFileSystem.js

Line 21 in 7ed24e0

    <tbody>

else if (context.options.writeToDisk !== true) {

The getFilenameFromUrl method is used to parse URL and build the local file path.
The public path prefix is stripped from the URL, and the unsecaped path suffix is appended to the outputPath:

webpack-dev-middleware/src/utils/getFilenameFromUrl.js

Line 82 in 7ed24e0

    <tbody>

if (

As the URL is not unescaped and normalized automatically before calling the midlleware, it is possible to use %2e and %2f sequences to perform path traversal attack.

PoC

A blank project can be created containing the following configuration file webpack.config.js:
module.exports = { devServer: { devMiddleware: { writeToDisk: true } } };

When started, it is possible to access any local file, e.g. /etc/passwd:
$ curl localhost:8080/public/..%2f..%2f..%2f..%2f../etc/passwd

root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin

Impact

The developers using webpack-dev-server or webpack-dev-middleware are affected by the issue. When the project is started, an attacker might access any file on the developer's machine and exfiltrate the content (e.g. password, configuration files, private source code, ...).

If the development server is listening on a public IP address (or 0.0.0.0), an attacker on the local network can access the local files without any interaction from the victim (direct connection to the port).

If the server allows access from third-party domains (CORS, Allow-Access-Origin: * ), an attacker can send a malicious link to the victim. When visited, the client side script can connect to the local server and exfiltrate the local files.

Recommendation

The URL should be unescaped and normalized before any further processing.

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

🆕 @​jsonjoy.com/base64 (added, 1.1.2)

🆕 @​jsonjoy.com/json-pack (added, 1.2.0)

🆕 @​jsonjoy.com/util (added, 1.5.0)

🆕 bundle-name (added, 4.1.0)

🆕 default-browser (added, 5.2.1)

🆕 default-browser-id (added, 5.0.0)

🆕 hyperdyperid (added, 1.2.0)

🆕 is-inside-container (added, 1.0.0)

🆕 is-network-error (added, 1.1.0)

🆕 run-applescript (added, 7.0.0)

🆕 thingies (added, 1.21.0)

🆕 tree-dump (added, 1.0.2)

🆕 schema-utils (added, 4.3.0)

🆕 encodeurl (added, 2.0.0)

🆕 memfs (added, 4.17.0)

🗑️ default-gateway (removed)

🗑️ html-entities (removed)

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu cancel merge

Cancels automatic merging of this PR

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)