webpack-subresource-integrity Integrity Validation Vulnerability in Dynamically Loaded Chunks

A vulnerability exists in the webpack-subresource-integrity plugin, specifically in version 1.5.0, where dynamically loaded chunks are assigned an incorrect integrity hash. This flaw prevents browsers from properly validating the integrity of these chunks, thereby undermining the additional protection that Subresource Integrity (SRI) is meant to provide. In contrast, top-level chunks remain unaffected. The issue arises from a bug introduced in version 1.5.0, which was later corrected in version 1.5.1.

Impact

The vulnerability leads to a failure in integrity validation for dynamically loaded chunks, allowing these chunks to be loaded without the usual integrity checks. This could potentially be exploited to introduce malicious content or scripts, bypassing the integrity protections that SRI is designed to enforce.

Reproduction

To reproduce this vulnerability, use webpack version 4.44.2 and include the webpack-subresource-integrity plugin version 1.5.0 in your project. When dynamically loaded chunks are imported, they will be injected with an 'undefined' integrity value, which browsers recognize as a malformed hash. This can be verified by checking the integrity attribute of the script elements for the dynamically loaded chunks, which will show 'undefined' instead of the expected hash value.

Remediation

Upgrade to webpack-subresource-integrity version 1.5.1, which addresses the integrity hash lookup for dynamic chunks. After upgrading, ensure that any cached versions of the files are cleared or bumped to allow the browser to fetch the updated scripts with the correct integrity values.