webpack-dev-middleware Path Traversal Vulnerability Allowing Arbitrary File Access

A path traversal vulnerability has been identified in the webpack-dev-middleware package, specifically in versions prior to 7.1.0, 6.1.2, and 5.3.4. The vulnerability arises because the middleware does not properly validate URL addresses before returning local files, allowing access to any file on the developer's machine. This issue can be exploited when the writeToDisk option is enabled, as it activates the physical filesystem instead of a virtualized in-memory filesystem. The vulnerability can be exploited directly or through a client-side script if the development server is accessible from a public IP or third-party domains.

Impact

Exploitation of this vulnerability allows for unauthorized access to files on the developer's machine, potentially leading to the exfiltration of sensitive information such as passwords, configuration files, or private source code.

Reproduction

To reproduce this vulnerability, create a blank project with webpack-dev-middleware and enable the writeToDisk option. Once the development server is running, use a URL-encoded path traversal sequence to access files outside the intended directory, such as /etc/passwd.

Remediation

Users can update to webpack-dev-middleware versions 7.1.0, 6.1.2, or 5.3.4, where this vulnerability has been patched.