Vulnerability · Published Dec 29, 2023 · Assigned by cloudflare
CVE-2023-7079Arbitrary remote file read in Wrangler dev server
Medium 6.4
In plain English
A medium-severity improper authentication in wrangler from Cloudflare. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Sending specially crafted HTTP requests and inspector messages to Wrangler's dev server could result in any file on the user's computer being accessible over the local network. An attacker that could trick any user on the local network into opening a malicious website could also read any file.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | wrangler | 3.19.0 | GHSA-cfph-4qqh-w828 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Cloudflare | wrangler | 0 – through 3.9.00 – before 3.19.0 |
Weakness: CWE-287 · Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N