CVE-2023-7079
published 2023-12-29CVE-2023-7079: Sending specially crafted HTTP requests and inspector messages to Wrangler's dev server could result in any file on the user's computer being accessible over…
PriorityP426medium5.7CVSS 3.1
AVAACLPRNUIRSUCHINAN
EPSS
0.70%
48.5th percentile
Sending specially crafted HTTP requests and inspector messages to Wrangler's dev server could result in any file on the user's computer being accessible over the local network. An attacker that could trick any user on the local network into opening a malicious website could also read any file.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cloudflare | wrangler | < 3.19.0 | 3.19.0 |
| cloudflare | wrangler | <= 3.9.0 | — |
| cloudflare | wrangler | >= 3.9.0 < 3.19.0 | 3.19.0 |
| cloudflare | wrangler | >= 3.9.0 < 3.19.0 | 3.19.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Arbitrary remote file read in Wrangler dev server
ghsa·2024-01-03
CVE-2023-7079 [MEDIUM] CWE-287 Arbitrary remote file read in Wrangler dev server
Arbitrary remote file read in Wrangler dev server
### Impact
Sending specially crafted HTTP requests and inspector messages to Wrangler's dev server could result in any file on the user's computer being accessible over the local network. An attacker that could trick any user on the local network into opening a malicious website could also read any file.
### Patches
This issue was fixed in `[email protected]`. Wrangler will now only serve files that are part of your bundle, or referenced by your bundle's source maps.
### Workarounds
Configure Wrangler to listen on local interfaces instead with `wrangler dev --ip 127.0.0.1`. This is the [default as of `[email protected]`](https://github.com/cloudflare/workers-sdk/security/advisories/GHSA-f8mp-x433-5wpf), and removes the local network as an at
OSV
Arbitrary remote file read in Wrangler dev server
osv·2024-01-03
CVE-2023-7079 [MEDIUM] Arbitrary remote file read in Wrangler dev server
Arbitrary remote file read in Wrangler dev server
### Impact
Sending specially crafted HTTP requests and inspector messages to Wrangler's dev server could result in any file on the user's computer being accessible over the local network. An attacker that could trick any user on the local network into opening a malicious website could also read any file.
### Patches
This issue was fixed in `[email protected]`. Wrangler will now only serve files that are part of your bundle, or referenced by your bundle's source maps.
### Workarounds
Configure Wrangler to listen on local interfaces instead with `wrangler dev --ip 127.0.0.1`. This is the [default as of `[email protected]`](https://github.com/cloudflare/workers-sdk/security/advisories/GHSA-f8mp-x433-5wpf), and removes the local network as an at
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/cloudflare/workers-sdk/pull/4532https://github.com/cloudflare/workers-sdk/pull/4535https://github.com/cloudflare/workers-sdk/security/advisories/GHSA-cfph-4qqh-w828https://github.com/cloudflare/workers-sdk/pull/4532https://github.com/cloudflare/workers-sdk/pull/4535https://github.com/cloudflare/workers-sdk/security/advisories/GHSA-cfph-4qqh-w828
2023-12-29
Published