CVE-2024-34344
📋 TL;DR
This vulnerability allows server-side JavaScript execution through insufficient path validation in Nuxt's test component wrapper. Attackers can achieve remote code execution by tricking users into visiting malicious web pages while running local tests. Only developers running Nuxt tests locally are affected.
💻 Affected Systems
- Nuxt framework
📦 What is this software?
Nuxt by Nuxt
⚠️ Risk & Real-World Impact
Worst Case
Full remote code execution on the developer's machine, allowing attacker to steal credentials, install malware, or pivot to internal networks.
Likely Case
Local file read/write, credential theft from development environment, or installation of backdoors on developer workstations.
If Mitigated
No impact if tests aren't running or if proper network segmentation isolates test environments.
🎯 Exploit Status
Exploit requires user to visit malicious webpage while test server is running locally.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Nuxt 3.11.1
Vendor Advisory: https://github.com/nuxt/nuxt/security/advisories/GHSA-v784-fjjh-f8r4
Restart Required: Yes
Instructions:
1. Update Nuxt to version 3.11.1 or later using npm: npm update nuxt@latest 2. Restart any running test servers 3. Verify update with: npm list nuxt
🔧 Temporary Workarounds
Disable local test servers
allStop running Nuxt test servers when not actively testing
kill $(lsof -t -i:3000) # adjust port if different
Network isolation
allRun test servers in isolated network environments or containers
docker run -p 3000:3000 your-nuxt-app # example
🧯 If You Can't Patch
- Never browse the web while running Nuxt test servers
- Use separate user accounts or virtual machines for development testing
🔍 How to Verify
Check if Vulnerable:
Check Nuxt version: npm list nuxt | grep nuxt. If version is below 3.11.1, you're vulnerable.Check Version:
npm list nuxt | grep nuxtVerify Fix Applied:
After updating, verify version is 3.11.1 or higher: npm list nuxt | grep nuxt📡 Detection & Monitoring
Log Indicators:
- Unusual JavaScript execution in test logs
- Unexpected file system access from test processes
- Test server responding to external requests
Network Indicators:
- Test server port (typically 3000) accepting external connections
- Unusual outbound connections from test processes
SIEM Query:
process.name:"node" AND process.args:"test" AND network.destination.port:3000