Nuxt Development Server CORS Vulnerability Allowing Code Access

A CORS vulnerability has been identified in Nuxt versions 3.8.1 prior to 3.15.3, allowing any website to send requests to the Nuxt development server and read the responses. This issue arises from default CORS settings that permit all origins to access the server. As a result, malicious websites could potentially steal source code from applications running on the affected Nuxt version.

Impact

Exploitation of this vulnerability could lead to unauthorized access to the source code of Nuxt applications, allowing malicious websites to steal sensitive information or intellectual property.

Reproduction

To reproduce this vulnerability, start a Nuxt development server using a version between 3.8.1 and 3.15.3. Then, from a malicious website, send a fetch request to the Nuxt server. The response will include the requested resource, bypassing CORS restrictions.

Remediation

Users can upgrade to Nuxt version 3.15.3 or later, where this vulnerability has been fixed. Instructions for updating Nuxt can be found in the Nuxt documentation.