Version Details and Security Vulnerabilities

📦

@nuxt/vite-builder

3.15.2

Comparision Betweeen 3.15.2 and 3.15.1

Identify the differences between the current version of the package and the previous one.

Version

Dependencies

Dev Dependencies

Peer Dependencies

Distributed Files

Unpacked Size

75.04 KB

74.84 KB

Version 3.15.2 Details

@nuxt/vite-builder version 3.15.2 is a minor update over 3.15.1, designed to enhance the Vite bundler integration within Nuxt 3 projects. The core functionality remains consistent, offering a performant and efficient build process leveraging Vite's capabilities such as rapid hot module replacement (HMR) and optimized production builds, making it ideal for developers focused on speed and modern web development practices.

Key changes reside in the updated dependencies. Notably, "h3" sees a bump from version ^1.13.0 to ^1.13.1. "mlly" updates from version ^1.7.3 to ^1.7.4, "@nuxt/kit" goes from "3.15.1" to "3.15.2", "consola" jumps from ^3.3.3 to ^3.4.0, "postcss" goes from ^8.4.49 to ^8.5.1, and "pkg-types" goes from ^1.3.0 to ^1.3.1. Also "rollup" goes from ^4.29.1 to ^4.30.1. These updates likely include bug fixes, performance improvements, and potentially new features within those specific packages. While seemingly minor, these dependency upgrades contribute to a more stable and refined build process, reducing potential compatibility issues or unexpected errors experienced by developers.

Developers already using @nuxt/vite-builder in their Nuxt projects should consider upgrading to 3.15.2 to benefit from these incremental improvements. The peer dependency of Vue remains at "^3.3.4", ensuring compatibility for those using Vue 3. This new version ensures you are running more optimised and stable code for your Nuxt 3 project. The file size increased slightly from 76634 to 76837.

Security Vulnerabilities

This site is an independent open-source project and is not affiliated with, endorsed by, or sponsored by npm, Inc. or GitHub, Inc. The name “npm” is a registered trademark of npm, Inc., used here solely to describe compatibility and reference publicly available npm package data.

Version Details and Security Vulnerabilities

📦

@nuxt/vite-builder

3.15.2

Comparision Betweeen 3.15.2 and 3.15.1

Identify the differences between the current version of the package and the previous one.

Version

Dependencies

Dev Dependencies

Peer Dependencies

Distributed Files

Unpacked Size

75.04 KB

74.84 KB

Version 3.15.2 Details

Security Vulnerabilities

Security Details

Comprehensive list of direct or transitive vulnerabilities for version 3.15.2 of the package @nuxt/vite-builder.

All Security Vulnerabilities

All the vulnerabilities related to the version 3.15.2 of the package

Summary:

Opening a malicious website while running a Nuxt dev server could allow read-only access to code

Details:

Summary

Nuxt allows any websites to send any requests to the development server and read the response due to default CORS settings.

Details

While Vite patched the default CORS settings to fix https://github.com/vitejs/vite/security/advisories/GHSA-vg6x-rcgg-rjx6, nuxt uses its own CORS handler by default (https://github.com/nuxt/nuxt/pull/23995).

https://github.com/nuxt/nuxt/blob/7d345c71462d90187fd09c96c7692f306c90def5/packages/vite/src/client.ts#L257-L263

That CORS handler sets Access-Control-Allow-Origin: *.

[!IMPORTANT]
If on an affected version, it may be possible to opt-out of the default Nuxt CORS handler by configuring vite.server.cors.

PoC

Start a dev server in any nuxt project using Vite by nuxt dev.
Send a fetch request to http://localhost:3000/_nuxt/app.vue (fetch('http://localhost:3000/_nuxt/app.vue')) from a different origin page.

Impact

Users with the default server.cors option using Vite builder may get the source code stolen by malicious websites

Additional Information

/__nuxt_vite_node__/manifest / /__nuxt_vite_node__/module also seems to have Access-Control-Allow-Origin: *, so it maybe also possible to exploit that handler. https://github.com/nuxt/nuxt/blob/7d345c71462d90187fd09c96c7692f306c90def5/packages/vite/src/vite-node.ts#L39 Although I didn't find a valid module id. Note that this handler is probably also vulnerable to DNS rebinding attacks as I didn't find any host header checks.

Details about @nuxt/vite-builder@3.15.2

Summary:

esbuild enables any website to send any requests to the development server and read the response

Details:

Summary

esbuild allows any websites to send any request to the development server and read the response due to default CORS settings.

Details

esbuild sets Access-Control-Allow-Origin: * header to all requests, including the SSE connection, which allows any websites to send any request to the development server and read the response.

https://github.com/evanw/esbuild/blob/df815ac27b84f8b34374c9182a93c94718f8a630/pkg/api/serve_other.go#L121 https://github.com/evanw/esbuild/blob/df815ac27b84f8b34374c9182a93c94718f8a630/pkg/api/serve_other.go#L363

Attack scenario:

The attacker serves a malicious web page (http://malicious.example.com).
The user accesses the malicious web page.
The attacker sends a fetch('http://127.0.0.1:8000/main.js') request by JS in that malicious web page. This request is normally blocked by same-origin policy, but that's not the case for the reasons above.
The attacker gets the content of http://127.0.0.1:8000/main.js.

In this scenario, I assumed that the attacker knows the URL of the bundle output file name. But the attacker can also get that information by

Fetching /index.html: normally you have a script tag here
Fetching /assets: it's common to have a assets directory when you have JS files and CSS files in a different directory and the directory listing feature tells the attacker the list of files
Connecting /esbuild SSE endpoint: the SSE endpoint sends the URL path of the changed files when the file is changed (new EventSource('/esbuild').addEventListener('change', e => console.log(e.type, e.data)))
Fetching URLs in the known file: once the attacker knows one file, the attacker can know the URLs imported from that file

The scenario above fetches the compiled content, but if the victim has the source map option enabled, the attacker can also get the non-compiled content by fetching the source map file.

PoC

Download reproduction.zip
Extract it and move to that directory
Run npm i
Run npm run watch
Run fetch('http://127.0.0.1:8000/app.js').then(r => r.text()).then(content => console.log(content)) in a different website's dev tools.

Impact

Users using the serve feature may get the source code stolen by malicious websites.

Details about esbuild@0.24.2

Security Details

Comprehensive list of direct or transitive vulnerabilities for version 3.15.2 of the package @nuxt/vite-builder.

All Security Vulnerabilities

All the vulnerabilities related to the version 3.15.2 of the package

Summary:

Opening a malicious website while running a Nuxt dev server could allow read-only access to code

Details:

Summary

Nuxt allows any websites to send any requests to the development server and read the response due to default CORS settings.

Details

https://github.com/nuxt/nuxt/blob/7d345c71462d90187fd09c96c7692f306c90def5/packages/vite/src/client.ts#L257-L263

That CORS handler sets Access-Control-Allow-Origin: *.

[!IMPORTANT]
If on an affected version, it may be possible to opt-out of the default Nuxt CORS handler by configuring vite.server.cors.

PoC

Start a dev server in any nuxt project using Vite by nuxt dev.
Send a fetch request to http://localhost:3000/_nuxt/app.vue (fetch('http://localhost:3000/_nuxt/app.vue')) from a different origin page.

Impact

Users with the default server.cors option using Vite builder may get the source code stolen by malicious websites

Additional Information

Details about @nuxt/vite-builder@3.15.2

Summary:

esbuild enables any website to send any requests to the development server and read the response

Details:

Summary

esbuild allows any websites to send any request to the development server and read the response due to default CORS settings.

Details

esbuild sets Access-Control-Allow-Origin: * header to all requests, including the SSE connection, which allows any websites to send any request to the development server and read the response.

Attack scenario:

The attacker serves a malicious web page (http://malicious.example.com).
The user accesses the malicious web page.
The attacker sends a fetch('http://127.0.0.1:8000/main.js') request by JS in that malicious web page. This request is normally blocked by same-origin policy, but that's not the case for the reasons above.
The attacker gets the content of http://127.0.0.1:8000/main.js.

In this scenario, I assumed that the attacker knows the URL of the bundle output file name. But the attacker can also get that information by

Fetching /index.html: normally you have a script tag here
Fetching /assets: it's common to have a assets directory when you have JS files and CSS files in a different directory and the directory listing feature tells the attacker the list of files
Connecting /esbuild SSE endpoint: the SSE endpoint sends the URL path of the changed files when the file is changed (new EventSource('/esbuild').addEventListener('change', e => console.log(e.type, e.data)))
Fetching URLs in the known file: once the attacker knows one file, the attacker can know the URLs imported from that file

The scenario above fetches the compiled content, but if the victim has the source map option enabled, the attacker can also get the non-compiled content by fetching the source map file.

PoC

Download reproduction.zip
Extract it and move to that directory
Run npm i
Run npm run watch
Run fetch('http://127.0.0.1:8000/app.js').then(r => r.text()).then(content => console.log(content)) in a different website's dev tools.

Impact

Users using the serve feature may get the source code stolen by malicious websites.

Details about esbuild@0.24.2

Version Details and Security Vulnerabilities

@nuxt/vite-builder

Comparision Betweeen 3.15.2 and 3.15.1

Version 3.15.2 Details

Security Vulnerabilities

Version Details and Security Vulnerabilities

@nuxt/vite-builder

Comparision Betweeen 3.15.2 and 3.15.1

Version 3.15.2 Details

Security Vulnerabilities

Security Details

All

Transitive Dependencies

Package

All Security Vulnerabilities

Summary

Details

PoC

Impact

Additional Information

Summary

Details

PoC

Impact

Security Details

All

Transitive Dependencies

Package

All Security Vulnerabilities

Summary

Details

PoC

Impact

Additional Information

Summary

Details

PoC

Impact

Version Details and Security Vulnerabilities

@nuxt/vite-builder

Comparision Betweeen 3.15.2 and 3.15.1

Version 3.15.2 Details

Security Vulnerabilities

Version Details and Security Vulnerabilities

@nuxt/vite-builder

Comparision Betweeen 3.15.2 and 3.15.1

Version 3.15.2 Details

Security Vulnerabilities

Security Details

All

Transitive Dependencies

Package

All Security Vulnerabilities

@nuxt/vite-builder@3.15.2 GHSA-2452-6xj8-jh47 5.3

Summary

Details

PoC

Impact

Additional Information

esbuild@0.24.2 GHSA-67mh-4wv8-2f99 5.3

Summary

Details

PoC

Impact

Security Details

All

Transitive Dependencies

Package

All Security Vulnerabilities

@nuxt/vite-builder@3.15.2 GHSA-2452-6xj8-jh47 5.3

Summary

Details

PoC

Impact

Additional Information

esbuild@0.24.2 GHSA-67mh-4wv8-2f99 5.3

Summary

Details

PoC

Impact