{"answers":{"affected":"6 open source packages ship an affected version, including webpack-dev-middleware. It affects 1 product.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-29180 exists.","fix":"Upgrade webpack-dev-middleware to a fixed version for your release line: 5.3.4, 6.1.2 or 7.1.0.","what":"CVE-2024-29180 is a high-severity path traversal vulnerability in webpack-dev-middleware, published on 21 Mar 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for CVE-2024-29180 and fix it if it is affected.\n\nWhat it is: CVE-2024-29180 is a high-severity path traversal vulnerability in webpack-dev-middleware, published on 21 Mar 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-29180 exists.\n\nAffected packages and fixed versions:\n- webpack-dev-middleware (npm): affected all versions; fixed in 5.3.4\n- webpack-dev-middleware (npm): affected all versions; fixed in 5.3.4\n- webpack-dev-middleware (npm): affected from 6.0.0; fixed in 6.1.2\n- webpack-dev-middleware (npm): affected from 6.0.0; fixed in 6.1.2\n- webpack-dev-middleware (npm): affected from 7.0.0; fixed in 7.1.0\n- webpack-dev-middleware (npm): affected from 7.0.0; fixed in 7.1.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2024-29180/ (Markdown: https://insights.sbomify.com/CVE-2024-29180/index.md)","id":"CVE-2024-29180","markdown":"https://insights.sbomify.com/CVE-2024-29180/index.md","name":"CVE-2024-29180","record":{"aliases":["CLSA-2026-1774311626","CLSA-2026-1774311628","CLSA-2026-1774311629","CLSA-2026-1774311637","CLSA-2026-1776299675","CLSA-2026-1776299676","CLSA-2026-1779238049","CLSA-2026-1779238056","CLSA-2026-1784596341","CLSA-2026-1784856457","CLSA-2026-1789721764","CLSA-2026-1790520250","CLSA-2026-1790866070","CLSA-2026-1790866099","GHSA-wr3j-pwj9-hqq6","ROOT-APP-NPM-CVE-2024-29180"],"analysis":{"component_type":"developer_tool","fix_type":"upgrade","impacts":["data_read"],"network_reachable":"yes","non_default_config":false,"product_category":"webpack dev middleware","requires_auth":"none","summary":"Attackers can read arbitrary files on developer machines via path traversal in webpack-dev-middleware due to insufficient URL validation.","user_interaction":"required","vuln_class":"path_traversal"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"webpack-dev-middleware","vendor":"webpack.js"}],"cvss":{"score":7.4,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","version":"3.1"},"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"}],"description":"Prior to versions 7.1.0, 6.1.2, and 5.3.4, the webpack-dev-middleware development middleware for devpack does not validate the supplied URL address sufficiently before returning the local file. It is possible to access any file on the developer's machine. The middleware can either work with the physical filesystem when reading the files or it can use a virtualized in-memory `memfs` filesystem. If `writeToDisk` configuration option is set to `true`, the physical filesystem is used. The `getFilenameFromUrl` method is used to parse URL and build the local file path. The public path prefix is stripped from the URL, and the `unsecaped` path suffix is appended to the `outputPath`. As the URL is not unescaped and normalized automatically before calling the midlleware, it is possible to use `%2e` and `%2f` sequences to perform path traversal attack.\n\nDevelopers using `webpack-dev-server` or `webpack-dev-middleware` are affected by the issue. When the project is started, an attacker might access any file on the developer's machine and exfiltrate the content. If the development server is listening on a public IP address (or `0.0.0.0`), an attacker on the local network can access the local files without any interaction from the victim (direct connection to the port). If the server allows access from third-party domains, an attacker can send a malicious link to the victim. When visited, the client side script can connect to the local server and exfiltrate the local files. Starting with fixed versions 7.1.0, 6.1.2, and 5.3.4, the URL is unescaped and normalized before any further processing.","ecosystems":["npm"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":true,"headline":"webpack-dev-middleware Path Traversal vulnerability","id":"CVE-2024-29180","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"npm","product":null,"products":[],"type":"path_traversal","year":"2024"},"n_packages":6,"n_references":9,"next":{"headline":"@strapi/plugin-content-manager leaks data via relations via the Admin Panel","id":"CVE-2024-29181"},"packages":[{"ecosystem":"npm","fixed":["5.3.4"],"introduced":["0"],"last_affected":[],"package":"webpack-dev-middleware","purl":null,"source":"GHSA-wr3j-pwj9-hqq6"},{"ecosystem":"npm","fixed":["5.3.4"],"introduced":["0"],"last_affected":[],"package":"webpack-dev-middleware","purl":"pkg:npm/webpack-dev-middleware","source":"GHSA-wr3j-pwj9-hqq6"},{"ecosystem":"npm","fixed":["6.1.2"],"introduced":["6.0.0"],"last_affected":[],"package":"webpack-dev-middleware","purl":null,"source":"GHSA-wr3j-pwj9-hqq6"},{"ecosystem":"npm","fixed":["6.1.2"],"introduced":["6.0.0"],"last_affected":[],"package":"webpack-dev-middleware","purl":"pkg:npm/webpack-dev-middleware","source":"GHSA-wr3j-pwj9-hqq6"},{"ecosystem":"npm","fixed":["7.1.0"],"introduced":["7.0.0"],"last_affected":[],"package":"webpack-dev-middleware","purl":null,"source":"GHSA-wr3j-pwj9-hqq6"},{"ecosystem":"npm","fixed":["7.1.0"],"introduced":["7.0.0"],"last_affected":[],"package":"webpack-dev-middleware","purl":"pkg:npm/webpack-dev-middleware","source":"GHSA-wr3j-pwj9-hqq6"}],"prev":{"headline":"phpMyFAQ Stored Cross-site Scripting at File Attachments","id":"CVE-2024-29179"},"products":["webpack-dev-middleware"],"published":"2024-03-21","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"poc","technical_impact":"partial"},"state":"PUBLISHED","updated":"2024-08-02","vendors":["webpack"]},"summary":"Attackers can read arbitrary files on developer machines via path traversal in webpack-dev-middleware due to insufficient URL validation.","url":"https://insights.sbomify.com/CVE-2024-29180/"}