CVE-2023-7080 – This vulnerability in Cloudflare Wrangler's dev... (How to Fix)

📋 TL;DR

This vulnerability in Cloudflare Wrangler's development server allowed arbitrary code execution within Workers sandbox via the V8 inspector. Attackers on the local network could connect to the inspector server and execute code, potentially accessing production resources when using wrangler dev --remote. Users running vulnerable versions of wrangler dev on shared networks were affected.

💻 Affected Systems

Products:

Cloudflare Wrangler

Versions: wrangler versions before 3.19.0 and 2.20.2

Operating Systems: All

Default Config Vulnerable: ⚠️ Yes

Notes: Vulnerability specifically affects wrangler dev command. The SSRF vulnerability in miniflare (CVE-2023-7078) extended network access until wrangler@3.18.0.

📦 What is this software?

Wrangler by Cloudflare

View all CVEs affecting Wrangler →

Wrangler by Cloudflare

View all CVEs affecting Wrangler →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attacker gains remote code execution on developer's machine, accesses production Cloudflare Workers resources, and potentially compromises sensitive data or infrastructure.

🟠

Likely Case

Attacker on same local network executes arbitrary code within the Workers sandbox, potentially accessing bound resources and developer environment.

🟢

If Mitigated

Limited to localhost access only, preventing network-based attacks while maintaining debugging functionality.

🌐 Internet-Facing: LOW

🏢 Internal Only: HIGH

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires attacker on same local network. No authentication needed to connect to inspector server in vulnerable versions.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: wrangler@3.19.0 and wrangler@2.20.2

Vendor Advisory: https://github.com/cloudflare/workers-sdk/security/advisories/GHSA-f8mp-x433-5wpf

Restart Required: Yes

Instructions:

1. Update wrangler using npm: npm install -g wrangler@latest
2. Verify installation: wrangler --version
3. Restart any running wrangler dev sessions

🔧 Temporary Workarounds

Disable inspector server

all

Run wrangler dev without inspector server enabled

wrangler dev --inspector-port=0

Use localhost binding only

all

Force inspector to bind only to localhost interfaces

wrangler dev --inspector-host=localhost

🧯 If You Can't Patch

Do not run wrangler dev on shared or untrusted networks
Use network segmentation to isolate development machines from other network devices

🔍 How to Verify

Check if Vulnerable:

Check wrangler version: wrangler --version. If version is below 3.19.0 (for v3) or below 2.20.2 (for v2), you are vulnerable.

Check Version:

wrangler --version

Verify Fix Applied:

After updating, verify version shows 3.19.0+ or 2.20.2+. Test that inspector server only listens on localhost interfaces.

📡 Detection & Monitoring

Log Indicators:

Unexpected connections to inspector port (default 9229)
Network connections from unexpected IPs to wrangler dev process

Network Indicators:

TCP connections to port 9229 from non-localhost addresses
HTTP requests to inspector endpoint without proper Origin/Host headers

SIEM Query:

destination.port:9229 AND NOT source.ip:127.0.0.1 AND NOT source.ip: ::1

📊 Metadata

CVE ID: CVE-2023-7080

CVSS v3 Score: 8.5 (HIGH)

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

CWE: CWE-269

Published: December 29, 2023

Last Updated: November 21, 2024

🔗 References

https://github.com/cloudflare/workers-sdk/issues/4430 Issue Tracking,Patch
https://github.com/cloudflare/workers-sdk/pull/4437 Patch
https://github.com/cloudflare/workers-sdk/pull/4535 Patch
https://github.com/cloudflare/workers-sdk/pull/4550 Patch
https://github.com/cloudflare/workers-sdk/security/advisories/GHSA-f8mp-x433-5wpf Mitigation,Patch,Third Party Advisory
https://github.com/cloudflare/workers-sdk/issues/4430 Issue Tracking,Patch
https://github.com/cloudflare/workers-sdk/pull/4437 Patch
https://github.com/cloudflare/workers-sdk/pull/4535 Patch
https://github.com/cloudflare/workers-sdk/pull/4550 Patch
https://github.com/cloudflare/workers-sdk/security/advisories/GHSA-f8mp-x433-5wpf Mitigation,Patch,Third Party Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2023-7080, you might also want to check these: