CVE-2025-30360 Overview
CVE-2025-30360 is a Cross-site WebSocket Hijacking vulnerability affecting webpack-dev-server, a popular development tool that provides live reloading capabilities for webpack-based projects. This vulnerability allows attackers to steal source code from developers who visit a malicious website while using non-Chromium based browsers.
The flaw stems from an incomplete fix for a previous vulnerability (CVE-2018-14732). While the Origin header validation was implemented to prevent Cross-site WebSocket hijacking attacks, webpack-dev-server incorrectly allows all IP address Origin headers regardless of their source. This permissive behavior enables websites served on IP addresses to establish WebSocket connections to the development server, potentially exfiltrating sensitive source code.
Critical Impact
Attackers can steal application source code, including proprietary algorithms, API keys, credentials, and other sensitive information embedded in development projects through malicious websites targeting developers using non-Chromium browsers.
Affected Products
- webpack.js webpack-dev-server versions prior to 5.2.1
Discovery Timeline
- 2025-06-03 - CVE CVE-2025-30360 published to NVD
- 2025-11-21 - Last updated in NVD database
Technical Details for CVE-2025-30360
Vulnerability Analysis
This vulnerability represents an Origin Validation Error (CWE-346), where the security control intended to prevent unauthorized WebSocket connections fails to properly validate IP address-based origins. The webpack-dev-server implements Origin header checking as a defense against Cross-site WebSocket hijacking attacks, a technique where malicious websites abuse WebSocket connections to interact with local development servers.
However, the implementation contains a critical oversight: IP address Origin headers are universally trusted without verification. When a developer visits a malicious website hosted on an IP address (rather than a domain name), the attacker-controlled site can establish a WebSocket connection to the victim's locally running webpack-dev-server instance.
This attack vector specifically affects non-Chromium based browsers (such as Firefox, Safari, and others), as Chromium-based browsers implement additional security measures that mitigate this attack surface. Through the hijacked WebSocket connection, an attacker can request and receive source code files being served by the development server.
Root Cause
The root cause lies in the Origin header validation logic within the Server.js file of webpack-dev-server. The code path that handles Origin header verification was designed to be permissive with IP address origins for legitimate local development scenarios. However, this design decision creates a security gap where any IP address-based Origin is accepted, including those from remote attacker-controlled servers.
The vulnerable code section can be found in the Server.js implementation. The fix in version 5.2.1 addresses this by implementing stricter validation that distinguishes between legitimate local IP addresses and potentially malicious remote IP addresses.
Attack Vector
The attack requires user interaction where a developer running webpack-dev-server visits a malicious website while their development server is active. The malicious site, served from an IP address rather than a domain name, initiates a WebSocket connection to the victim's localhost development server. Due to the permissive IP address Origin validation, this connection is accepted.
Once connected, the attacker's JavaScript code can enumerate and request source files through the WebSocket interface, exfiltrating the victim's source code to the attacker's server. The attack is particularly effective against developers using Firefox, Safari, or other non-Chromium browsers.
Detection Methods for CVE-2025-30360
Indicators of Compromise
- Unexpected WebSocket connections to the webpack-dev-server from external IP addresses
- Network traffic showing source code being transmitted to external destinations during development sessions
- Browser developer tools showing WebSocket connections to localhost from pages served on IP addresses
- Unusual outbound network activity from development machines during browsing sessions
Detection Strategies
- Monitor WebSocket connection logs for connections originating from unexpected IP address-based origins
- Implement network monitoring to detect outbound transfers of source code or development artifacts
- Review browser history correlation with webpack-dev-server access logs for suspicious timing patterns
- Deploy endpoint detection and response (EDR) solutions to identify data exfiltration attempts from development workstations
Monitoring Recommendations
- Enable verbose logging in webpack-dev-server to track all incoming WebSocket connection attempts and their origin headers
- Configure network security tools to alert on unusual data patterns leaving development environments
- Implement browser extensions or policies that restrict WebSocket connections from untrusted origins
- Regularly audit webpack-dev-server configuration and version across development teams
How to Mitigate CVE-2025-30360
Immediate Actions Required
- Upgrade webpack-dev-server to version 5.2.1 or later immediately
- Audit development environments to identify all instances running vulnerable versions
- Consider using Chromium-based browsers for development activities until the upgrade is complete
- Review network logs for any signs of historical exploitation
Patch Information
The vulnerability has been addressed in webpack-dev-server version 5.2.1. The fix implements proper validation of IP address Origin headers, ensuring that only legitimate local development connections are accepted. Two commits address this issue:
For complete details, refer to the GitHub Security Advisory GHSA-9jgg-88mc-972h.
Workarounds
- Use Chromium-based browsers (Chrome, Edge, Brave) exclusively for web browsing while running webpack-dev-server, as they provide additional protections against this attack
- Configure webpack-dev-server to only accept connections from localhost or specific trusted origins using the allowedHosts configuration option
- Implement network-level controls to block WebSocket connections from development servers to external destinations
- Run webpack-dev-server in isolated network environments or containers with restricted outbound connectivity
# Configuration example - Update package.json to use patched version
npm install webpack-dev-server@5.2.1 --save-dev
# Verify installed version
npm list webpack-dev-server
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
