Improper Authorization vulnerability in React Developer Tools extension
Summary
CVE-2023-5654: React Developer Tools extension Improper Authorization vulnerability. Affects react-devtools-core versions < 4.28.4. Fixed in 4.28.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
React Developer Tools is a browser extension that allows developers to inspect and debug React components in their applications. It provides a set of tools and features to analyze the component hierarchy, inspect props and state, and monitor component performance. The extension is widely used by React developers to enhance their development workflow and improve the quality of their applications. However, a vulnerability has been discovered in the extension that could allow malicious websites to exploit improper authorization and fetch arbitrary URLs through the victim's browser.
Vulnerability Detail
The React Developer Tools extension registers a message listener with window.addEventListener('message', <listener>) in a content script that is accessible to any webpage that is active in the browser. Within the listener is code that requests a URL derived from the received message via fetch(). The URL is not validated or sanitized before it is fetched, thus allowing a malicious web page to arbitrarily fetch URLs via the victim's browser. This vulnerability can lead to various attacks, such as cross-site scripting (XSS), data exfiltration, and remote code execution.
How To Fix
Minimum fixed version
4.28.4
This is the first release that contains the fix.
npm install react-devtools-core@4.28.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable or uninstall the React Developer Tools extension to mitigate the risk of exploitation. However, this may impact the ability to inspect and debug React components in the browser.
Conclusion
The React Developer Tools extension is vulnerable to an improper authorization issue that allows malicious websites to fetch arbitrary URLs through the victim's browser. It is crucial to update the extension to the latest version or follow the recommended fixes to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for react-devtools-core →
FAQ
The React Developer Tools extension is a browser extension that allows developers to inspect and debug React components in their applications.
The vulnerability allows malicious websites to exploit improper authorization in the extension and fetch arbitrary URLs through the victim's browser.
The vulnerability can lead to various attacks, such as cross-site scripting (XSS), data exfiltration, and remote code execution.
To fix this vulnerability, the React Developer Tools extension should implement proper authorization checks before fetching URLs and consider implementing a content security policy (CSP).
As a temporary workaround, users can disable or uninstall the React Developer Tools extension to mitigate the risk of exploitation.
