Platform
nodejs
Component
nuxt
Fixed in
3.4.1
3.12.4
CVE-2024-34344 describes a Remote Code Execution (RCE) vulnerability within the Nuxt framework. This flaw stems from inadequate validation of the path parameter within the NuxtTestComponentWrapper component, enabling attackers to execute arbitrary JavaScript on the server-side. The vulnerability impacts versions of Nuxt prior to 3.12.4, and a patch has been released to address the issue.
Successful exploitation of CVE-2024-34344 allows an attacker to execute arbitrary JavaScript code on the server hosting the Nuxt application. This can lead to complete system compromise, including data exfiltration, modification, or deletion. An attacker could potentially gain control of the server, install malware, or pivot to other systems within the network. The impact is particularly severe because the vulnerability allows for remote code execution without authentication, making it easily exploitable.
CVE-2024-34344 is not currently listed on the CISA KEV catalog. Public proof-of-concept (PoC) code is likely to emerge given the ease of exploitation and the RCE nature of the vulnerability. The vulnerability's straightforward exploitation pattern suggests a potential for rapid adoption by malicious actors. The vulnerability was publicly disclosed on 2024-08-05.
Exploit Status
EPSS
1.31% (80% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2024-34344 is to upgrade to Nuxt version 3.12.4 or later, which includes the necessary fix. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to block requests containing malicious path parameters. Carefully review and restrict access to the NuxtTestComponentWrapper component, limiting its usage to trusted contexts. Monitor server logs for suspicious activity related to component loading and execution. After upgrade, confirm the fix by attempting to trigger the vulnerable component with a crafted path and verifying that the execution is blocked.
Actualice Nuxt a la versión 3.12.4 o superior. Esta versión corrige la vulnerabilidad de ejecución remota de código. La actualización se puede realizar a través de npm o yarn, dependiendo de su gestor de paquetes.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2024-34344 is a Remote Code Execution vulnerability in Nuxt, allowing attackers to execute arbitrary JavaScript on the server due to insufficient path validation in the NuxtTestComponentWrapper component.
You are affected if you are using Nuxt versions prior to 3.12.4. Assess your Nuxt deployment to determine if it is vulnerable.
Upgrade to Nuxt version 3.12.4 or later to resolve the vulnerability. If immediate upgrade is not possible, implement WAF rules and restrict access to the vulnerable component.
While no active exploitation has been confirmed, the ease of exploitation suggests a high probability of exploitation in the near future.
Refer to the official Nuxt security advisory for detailed information and updates: https://github.com/nuxt/nuxt/security/advisories/CVE-2024-34344
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.