Code Sniffing

2018-11-0906:26:16

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.006 Low

EPSS

Percentile

78.5%

JSON

browserify-hms is vulnerable to code sniffing. The code sniffing is possible because WebSocket server for HMR (Hot Module Replacement) does not validate the origin of the request, allowing unauthorised users to access HMR message sent by the WebSocket server via a ws://127.0.0.1:8080/ connection from any origin.

CPENameOperatorVersion
browserify-hmrle0.3.7

CPE	Name	Operator	Version
	browserify-hmr	le	0.3.7

References

blog.cal1.cn/post/Sniffing%20Codes%20in%20Hot%20Module%20Reloading%20Messages

github.com/AgentME/browserify-hmr/issues/41

github.com/Macil/browserify-hmr/issues/41

www.npmjs.com/advisories/726

0.006 Low

EPSS

Percentile

78.5%

JSON

Related for VERACODE:7725