| Título | https://github.com/reduxjs/redux-devtools redux-devtools 5.0.0 Local sensitive logic exposure lead to Remote Code Exectuion |
|---|
| Descripción | The Redux DevTools remote-debugging architecture consists of two parts: the remotedev-server bundled inside @redux-devtools/cli (an event-relay service built on SocketCluster WebSocket) and the @redux-devtools/remote enhancer running in the debugged application (the victim). Once the user starts this software, the remotedev-server by default listens on x.x.x.x:8000; the debugged application connects to the server with realtime: true, subscribes to the control channel, and waits for remote commands.
The exploitation scenario is as follows: while the victim has this software running and at least one debugged application is connected, the victim visits a malicious web page in their browser. The malicious page's JavaScript uses the browser's native WebSocket to connect directly to ws://127.0.0.1:8000/socketcluster/. This succeeds because:
WebSocket connections are not subject to the Same-Origin Policy or CORS, and a local page opened via file:// can also initiate cross-origin WebSocket connections;
The server handshake requires no credentials (authToken: null is sufficient) and does not validate the Origin header;
The server middleware unconditionally forwards messages sent to the respond control channel to all subscribers;
The victim's client performs no source or instanceId validation on incoming {"type":"ACTION","action":"<arbitrary JS expression string>"} messages; it passes the payload directly to evalAction, which evaluates it via new Function('return ' + action)();
As a result, the malicious page needs to send only two JSON messages (START and ACTION) to make the victim process execute arbitrary attacker-supplied JavaScript within its own context — which can further call child_process to run system commands, read/write files, exfiltrate environment variables, and steal sensitive data held in memory. The entire process is blind-fire in nature: as soon as one message reaches the server and the victim executes it, the attack has succeeded; subscribing to the log channel to receive command output is only needed for demonstrating the result.
In addition to the browser vector, because the server binds to all network interfaces, any host on the same LAN can exploit it directly without a browser (in that case no user interaction is required, making the practical severity even higher).
Preconditions:
The victim has started this software (the server is thereby listening);
At least one debugged application using @redux-devtools/remote (realtime: true) is connected to the server — the Electron desktop client window itself is only a monitor, not the victim;
The browser vector requires the victim to visit a malicious web page; the LAN vector requires no interaction at all.
|
|---|
| Fuente | ⚠️ https://github.com/reduxjs/redux-devtools/issues/2125 |
|---|
| Usuario | Anonymous User |
|---|
| Sumisión | 2026-10-12 05:11 (hace 16 días) |
|---|
| Moderación | 2026-10-27 10:43 (15 days later) |
|---|
| Estado | Aceptado |
|---|
| Entrada de VulDB | 427087 [reduxjs redux-devtools 5.0.0 Remotedev Server evalAction action escalada de privilegios] |
|---|
| Puntos | 20 |
|---|