CVE-2025-30360
📋 TL;DR
Webpack-dev-server versions before 5.2.1 have a Cross-Site WebSocket Hijacking vulnerability that allows malicious websites to steal source code from development servers. The vulnerability occurs because the server improperly validates Origin headers, allowing connections from IP addresses. This affects developers using webpack-dev-server with non-Chromium browsers.
💻 Affected Systems
- webpack-dev-server
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers steal proprietary source code, intellectual property, and sensitive development artifacts from exposed development servers.
Likely Case
Source code leakage from development environments, potentially exposing API keys, credentials, and business logic.
If Mitigated
Limited impact if development servers are isolated from production networks and external access.
🎯 Exploit Status
Similar exploitation method to CVE-2018-14732. Attack requires user to visit malicious website while development server is running.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.2.1
Vendor Advisory: https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-9jgg-88mc-972h
Restart Required: Yes
Instructions:
1. Update webpack-dev-server to version 5.2.1 or later using npm: npm update webpack-dev-server@^5.2.1
2. Restart the development server
3. Verify the fix by checking the version
🔧 Temporary Workarounds
Use Chromium-based browsers
allSwitch to Chrome, Edge, or other Chromium-based browsers during development
Restrict development server access
allConfigure webpack-dev-server to only accept connections from localhost
webpack-dev-server --host localhost
🧯 If You Can't Patch
- Isolate development servers from production networks
- Use VPN or network segmentation to restrict access to development environments
🔍 How to Verify
Check if Vulnerable:
Check webpack-dev-server version: npm list webpack-dev-serverCheck Version:
npm list webpack-dev-serverVerify Fix Applied:
Confirm version is 5.2.1 or higher: npm list webpack-dev-server | grep webpack-dev-server📡 Detection & Monitoring
Log Indicators:
- WebSocket connection attempts from external IP addresses
- Unusual Origin headers in WebSocket requests
Network Indicators:
- WebSocket traffic to development server ports (typically 8080, 3000, 9000) from external sources
SIEM Query:
source_port IN (8080, 3000, 9000) AND protocol="websocket" AND dest_ip IN (development_server_ips)🔗 References
- https://github.com/webpack/webpack-dev-server/blob/55220a800ba4e30dbde2d98785ecf4c80b32f711/lib/Server.js#L3113-L3127
- https://github.com/webpack/webpack-dev-server/commit/5c9378bb01276357d7af208a0856ca2163db188e
- https://github.com/webpack/webpack-dev-server/commit/72efaab83381a0e1c4914adf401cbd210b7de7eb
- https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-9jgg-88mc-972h
