CVE-2024-23657

Nuxt Devtools is missing authentication on the getTextAssetContent RPC function which is vulnerable to path traversal. Combined with a lack of Origin checks on the WebSocket handler, an attacker is able to interact with a locally running devtools instance and exfiltrate data abusing this vulnerability.

In certain configurations an attacker could leak the devtools authentication token and then abuse other RPC functions to achieve RCE.

Details

The getTextAssetContent function does not check for path traversals (source), this could allow an attacker to read arbitrary files over the RPC WebSocket.

The WebSocket server does not check the origin of the request (source) leading to CSWSH. This may be intentional to allow certain configurations to work correctly.

Nuxt Devtools authentication tokens are placed within the home directory of the current user (source).

In the scenario that:

• The user has a Nuxt3 Project running
• Devtools is enabled and running
• The project is placed within the users home directory.
• The user visits a malicious webpage
• User has authenticated with devtools at least once

The malicious webpage can connect to the Devtools WebSocket, perform a directory traversal brute force to find the authentication token, then use the authenticated writeStaticAssets function to create a new Component, Nitro Handler or app.vue file which will run automatically as the file is changed.

PoC

POC will exploit the Devtools server on localhost:3000 (you may need to manually restart the server as the restart hook does not always work).

POC: https://devtools-exploit.pages.dev

1. Create a new project with nuxt.new.
2. Place the project inside your home directory.
3. Run pnpm run dev.
4. Open the POC page.

The POC will:

• Identify devtools version.
• Leak your devtools token.
• Create a new server handler with an insecure eval.

• All new Nuxt projects by default (devtools is enabled) are vulnerable to arbitrary file read.
• Certain Nuxt configurations are vulnerable to Remote Code Execution

Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files. Typical impact: unauthorized file read or write outside the intended directory.

CVE-2024-23657 has a CVSS score of 8.8 (High). The vector is network-reachable, no privileges required, and user interaction required. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (1.3.9); upgrading removes the vulnerable code path.

Kodem intelligence

1. What is CVE-2024-23657? CVE-2024-23657 is a high-severity path traversal vulnerability in @nuxt/devtools (npm), affecting versions < 1.3.9. It is fixed in 1.3.9. Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files.
2. How severe is CVE-2024-23657? CVE-2024-23657 has a CVSS score of 8.8 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of @nuxt/devtools are affected by CVE-2024-23657? @nuxt/devtools (npm) versions < 1.3.9 is affected.
4. Is there a fix for CVE-2024-23657? Yes. CVE-2024-23657 is fixed in 1.3.9. Upgrade to this version or later.
5. Is CVE-2024-23657 exploitable, and should I be worried? Whether CVE-2024-23657 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2024-23657 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2024-23657? Upgrade @nuxt/devtools to 1.3.9 or later.