Critical Vulnerability in Webpack: Cross-Realm Object Access in Node-Webpack
Summary
UBUNTU-CVE-2023-28154: Webpack 5 before 5.76.0 does not avoid cross-realm object access. Affects node-webpack versions 3.5.6-1build3 – 3.5.6-2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Webpack is a popular open-source JavaScript module bundler that compiles JavaScript modules into a single file or smaller chunks. It is widely used in modern web development to manage dependencies and optimize asset delivery. The affected package, node-webpack, is a Debian package that integrates Webpack into the Ubuntu ecosystem. The vulnerability in question allows attackers to exploit cross-realm object access, posing significant security risks.
Vulnerability Detail
The vulnerability identified as CVE-2023-28154 affects Webpack versions prior to 5.76.0. It arises from the mishandling of the magic comment feature in the ImportParserPlugin.js file. An attacker controlling a property of an untrusted object can gain access to the real global object, potentially leading to unauthorized access and manipulation of sensitive data. This vulnerability has a CVSS score of 9.8, indicating a critical level of severity.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider restricting access to untrusted objects and validating inputs to prevent attackers from exploiting this vulnerability. Additionally, avoid using the magic comment feature until the package is updated.
Conclusion
The vulnerability CVE-2023-28154 in Webpack poses significant security risks due to cross-realm object access. It is crucial for users of the node-webpack package to update to the latest patched version to mitigate these risks. Implementing workarounds can provide temporary relief until a full update is possible.
See every vulnerability recorded for node-webpack →
FAQ
CVE-2023-28154 is a critical vulnerability in Webpack that allows cross-realm object access due to improper handling of the magic comment feature.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 9.8, indicating a critical level of severity.
If immediate updates are not possible, implement input validation and restrict access to untrusted objects as a temporary workaround.
More information can be found in the Ubuntu security notices at https://github.com/canonical/ubuntu-security-notices.
Related vulnerabilities
Recent vulnerabilities recorded for node-webpack.
