Vulnerability · Published Oct 19, 2023 · Assigned by snyk

CVE-2023-5654

Medium 6.5

In plain English

A medium-severity security flaw in React Developer Tools Extension from Meta. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.6%top 53.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

The React Developer Tools extension registers a message listener with window.addEventListener('message', <listener>) in a content script that is accessible to any webpage that is active in the browser. Within the listener is code that requests a URL derived from the received message via fetch(). The URL is not validated or sanitised before it is fetched, thus allowing a malicious web page to arbitrarily fetch URL’s via the victim's browser.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	react-devtools-core	4.28.4	GHSA-rxrc-rgv4-jpvx

Affected products (as reported)

Vendor	Product	Versions
Meta	React Developer Tools Extension	< 4.28.4

Weakness: CWE-285, CWE-116 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

References

https://gist.github.com/CalumHutton/1fb89b64409570a43f89d1fd3274b231