webpack-dev-server users' source code may be stolen when they access a malicious web site with non-Chromium based browser
SummarySource code may be stolen when you access a malicious web site with non-Chromium based browser.DetailsThe `Origin` header is checked to prevent Cross-site WebSocket hijacking from happening which was reported by CVE-2018-14732.
But webpack-dev-server always allows IP address `Origin` headers.
https://github.com/webpack/webpack-dev-server/blob/55220a800ba4e30dbde2d98785ecf4c80b32f711/lib/Server.js#L3113-L3127
This allows websites that are served on IP addresses to connect WebSocket.
By using the same method described in [the article](https://blog.cal1.cn/post/Sniffing%20Codes%20in%20Hot%20Module%20Reloading%20Messages) linked from CVE-2018-14732, the attacker get the source code.related commit: https://github.com/webpack/webpack-dev-server/commit/72efaab83381a0e1c4914adf401cbd210b7de7eb (note that `checkHost` function was only used for Host header to prevent DNS rebinding attacks so this change itself is fine.This vulnerability does not affect Chrome 94+ (and other Chromium based browsers) users due to [the non-HTTPS private access blocking feature](https://developer.chrome.com/blog/private-network-access-update#chrome_94).PoCDownload [reproduction.zip](https://github.com/user-attachments/files/18418233/reproduction.zip) and extract itRun `npm i`Run `npx webpack-dev-server`Open `http://{ipaddress}/?target=http://localhost:8080&file=main` with a non-Chromium browser (I used Firefox 134.0.1)Edit `src/index.js` in the extracted directoryYou can see the content of `src/index.js`![image](https://github.com/user-attachments/assets/7ce3cad7-1a4d-4778-baae-1adae5e93ba4)The script in the POC site is:ImpactThis vulnerability can result in the source code to be stolen for users that uses a predictable port and uses a non-Chromium based browser.