Auth bypass in Facebook React-Devtools
CVE-2023-5654
The React Developer Tools extension registers a message listener with window.addEventListener('message', <listener>) in a content script that is accessible to any webpage that is active in the browser. Within the listener is code that requests a URL derived from the received message via fetch(). The URL is not validated or sanitised before it is fetched, thus allowing a malicious web page to arbitrarily fetch URL’s via the victim's browser.
EPSS: 0.005 (37.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L.
Affected products
- Facebook React-devtools
- Meta React Developer Tools Extension — versions < 4.28.4
Weakness classification (CWE)
References
- report@snyk.io (Patch, Third Party Advisory)
Frequently asked questions
- What is CVE-2023-5654?
- CVE-2023-5654 is a medium-severity vulnerability in Facebook React-Devtools, classified under Improper Authorization. CVSS score: 6.5/10. Published 2023-10-19.
- How severe is CVE-2023-5654?
- Medium severity. CVSS v3 base score is 6.5 out of 10.