CVE-2024-29180: Path Traversal in webpack-dev-middleware

The core of the vulnerability lies in insufficient URL validation within webpack-dev-middleware. When writeToDisk is set to true, the middleware directly serves files from the physical filesystem. An attacker can craft malicious URLs containing path traversal sequences (e.g., ../..) to navigate outside the intended serving directory and access arbitrary files on the server. This could expose sensitive configuration files, source code, or even system files, depending on the server's permissions. The impact is particularly severe in development environments where sensitive information might be inadvertently exposed. This vulnerability shares similarities with other path traversal exploits where improper input sanitization leads to unauthorized file access.

1. Reserved2024-03-18
2. Published2024-03-21
3. Modified2026-02-04
4. EPSS updated2026-04-02

The primary mitigation for CVE-2024-29180 is to upgrade to webpack-dev-middleware version 7.1.0 or later, which includes the necessary URL validation fixes. If upgrading is not immediately feasible, consider disabling the writeToDisk option entirely, which forces the middleware to use an in-memory filesystem and eliminates the risk of direct file access. As a temporary workaround, implement strict URL validation on the server-side to prevent path traversal attempts. This could involve whitelisting allowed characters or using a secure URL parsing library. After upgrading, verify the fix by attempting to access files outside the intended serving directory using crafted URLs; access should be denied.

Last updated

8.0.3recently