Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. Nuxt Devtools is missing authentication on the `getTextAssetContent` RPC function which is vulnerable to path traversal. Combined with a lack of Origin checks on the WebSocket handler, an attacker is able to interact with a locally running devtools instance and exfiltrate data abusing this vulnerability. In certain configurations an attacker could leak the devtools authentication token and then abuse other RPC functions to achieve RCE. The `getTextAssetContent` function does not check for path traversals, this could allow an attacker to read arbitrary files over the RPC WebSocket. The WebSocket server does not check the origin of the request leading to cross-site-websocket-hijacking. This may be intentional to allow certain configurations to work correctly. Nuxt Devtools authentication tokens are placed within the home directory of the current user. The malicious webpage can connect to the Devtools WebSocket, perform a directory traversal brute force to find the authentication token, then use the *authenticated* `writeStaticAssets` function to create a new Component, Nitro Handler or `app.vue` file which will run automatically as the file is changed. This vulnerability has been addressed in release version 1.3.9. All users are advised to upgrade. There are no known workarounds for this vulnerability.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js.
    Nuxt Devtools is missing authentication on the `getTextAssetContent` RPC function which is vulnerable to
    path traversal. Combined with a lack of Origin checks on the WebSocket handler, an attacker is able to
    interact with a locally running devtools instance and exfiltrate data abusing this vulnerability. In
    certain configurations an attacker could leak the devtools authentication token and then abuse other RPC
    functions to achieve RCE. The `getTextAssetContent` function does not check for path traversals, this
    could allow an attacker to read arbitrary files over the RPC WebSocket. The WebSocket server does not
    check the origin of the request leading to cross-site-websocket-hijacking. This may be intentional to
    allow certain configurations to work correctly. Nuxt Devtools authentication tokens are placed within the
    home directory of the current user. The malicious webpage can connect to the Devtools WebSocket, perform a
    directory traversal brute force to find the authentication token, then use the *authenticated*
    `writeStaticAssets` function to create a new Component, Nitro Handler or `app.vue` file which will run
    automatically as the file is changed. This vulnerability has been addressed in release version 1.3.9. All
    users are advised to upgrade. There are no known workarounds for this vulnerability. (CVE-2024-23657)

The version of Docker Desktop for Linux is prior to 4.27.1. It is therefore affected by multiple vulnerabilities.

  - runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In     runc 1.1.11 and earlier, due to an internal file descriptor leak, an attacker could cause a newly-spawned     container process (from runc exec) to have a working directory in the host filesystem namespace, allowing     for a container escape by giving access to the host filesystem (attack 2). The same attack could be used     by a malicious image to allow a container process to gain access to the host filesystem through runc run     (attack 1). Variants of attacks 1 and 2 could be also be used to overwrite semi-arbitrary host binaries,     allowing for complete container escapes (attack 3a and attack 3b). runc 1.1.12 includes patches for this     issue. (CVE-2024-21626)

  - BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and     repeatable manner. A malicious BuildKit client or frontend could craft a request that could lead to     BuildKit daemon crashing with a panic. The issue has been fixed in v0.12.5. As a workaround, avoid using     BuildKit frontends from untrusted sources. (CVE-2024-23650)

  - BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and     repeatable manner. Two malicious build steps running in parallel sharing the same cache mounts with     subpaths could cause a race condition that can lead to files from the host system being accessible to     the build container. The issue has been fixed in v0.12.5. Workarounds include, avoiding using BuildKit     frontend from an untrusted source or building an untrusted Dockerfile containing cache mounts with 
    --mount=type=cache,source=... options. (CVE-2024-23651)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Docker Desktop for Mac is prior to 4.27.1. It is therefore affected by multiple vulnerabilities.

  - runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In     runc 1.1.11 and earlier, due to an internal file descriptor leak, an attacker could cause a newly-spawned     container process (from runc exec) to have a working directory in the host filesystem namespace, allowing     for a container escape by giving access to the host filesystem (attack 2). The same attack could be used     by a malicious image to allow a container process to gain access to the host filesystem through runc run     (attack 1). Variants of attacks 1 and 2 could be also be used to overwrite semi-arbitrary host binaries,     allowing for complete container escapes (attack 3a and attack 3b). runc 1.1.12 includes patches for this     issue. (CVE-2024-21626)

  - BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and     repeatable manner. A malicious BuildKit client or frontend could craft a request that could lead to     BuildKit daemon crashing with a panic. The issue has been fixed in v0.12.5. As a workaround, avoid using     BuildKit frontends from untrusted sources. (CVE-2024-23650)

  - BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and     repeatable manner. Two malicious build steps running in parallel sharing the same cache mounts with     subpaths could cause a race condition that can lead to files from the host system being accessible to     the build container. The issue has been fixed in v0.12.5. Workarounds include, avoiding using BuildKit     frontend from an untrusted source or building an untrusted Dockerfile containing cache mounts with 
    --mount=type=cache,source=... options. (CVE-2024-23651)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Docker Desktop for Windows is prior to 4.27.1. It is therefore affected by multiple vulnerabilities.

  - runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In     runc 1.1.11 and earlier, due to an internal file descriptor leak, an attacker could cause a newly-spawned     container process (from runc exec) to have a working directory in the host filesystem namespace, allowing     for a container escape by giving access to the host filesystem (attack 2). The same attack could be used     by a malicious image to allow a container process to gain access to the host filesystem through runc run     (attack 1). Variants of attacks 1 and 2 could be also be used to overwrite semi-arbitrary host binaries,     allowing for complete container escapes (attack 3a and attack 3b). runc 1.1.12 includes patches for this     issue. (CVE-2024-21626)

  - BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and     repeatable manner. A malicious BuildKit client or frontend could craft a request that could lead to     BuildKit daemon crashing with a panic. The issue has been fixed in v0.12.5. As a workaround, avoid using     BuildKit frontends from untrusted sources. (CVE-2024-23650)

  - BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and     repeatable manner. Two malicious build steps running in parallel sharing the same cache mounts with     subpaths could cause a race condition that can lead to files from the host system being accessible to     the build container. The issue has been fixed in v0.12.5. Workarounds include, avoiding using BuildKit     frontend from an untrusted source or building an untrusted Dockerfile containing cache mounts with 
    --mount=type=cache,source=... options. (CVE-2024-23651)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
418675	SCA: security update for @nuxt/devtools (GHSA-rcvg-rgf7-pppv)	Tenable Cloud Security	SCA Checks	high
418675	SCA: security update for @nuxt/devtools (GHSA-rcvg-rgf7-pppv)	Tenable Self-Hosted Container Security	SCA Checks	high
190365	Docker Desktop < 4.27.1 Multiple Vulnerabilities	Nessus	Misc.	critical
190364	Docker Desktop < 4.27.1 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
190363	Docker Desktop < 4.27.1 Multiple Vulnerabilities	Nessus	Windows	critical

Detections

Analytics

CVE-2024-23657

high

Tenable Plugins

high

high

critical

critical

critical