CVE-2024-23657

Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. Nuxt Devtools is missing authentication on the `getTextAssetContent` RPC function which is vulnerable to path traversal. Combined with a lack of Origin checks on the WebSocket handler, an attacker is able to interact with a locally running devtools instance and exfiltrate data abusing this vulnerability. In certain configurations an attacker could leak the devtools authentication token and then abuse other RPC functions to achieve RCE. The `getTextAssetContent` function does not check for path traversals, this could allow an attacker to read arbitrary files over the RPC WebSocket. The WebSocket server does not check the origin of the request leading to cross-site-websocket-hijacking. This may be intentional to allow certain configurations to work correctly. Nuxt Devtools authentication tokens are placed within the home directory of the current user. The malicious webpage can connect to the Devtools WebSocket, perform a directory traversal brute force to find the authentication token, then use the *authenticated* `writeStaticAssets` function to create a new Component, Nitro Handler or `app.vue` file which will run automatically as the file is changed. This vulnerability has been addressed in release version 1.3.9. All users are advised to upgrade. There are no known workarounds for this vulnerability.

• CWE-22
• CWE-24
• CWE-22

• https://github.com/nuxt/devtools/blob/c4f2b68281203fc3f61ffc97d9c6623fbfde46bb/packages/devtools/src/dev-auth.ts#L14Issue Tracking
• https://github.com/nuxt/devtools/blob/c4f2b68281203fc3f61ffc97d9c6623fbfde46bb/packages/devtools/src/server-rpc/assets.ts#L88C48-L88C48Issue Tracking
• https://github.com/nuxt/devtools/blob/c4f2b68281203fc3f61ffc97d9c6623fbfde46bb/packages/devtools/src/server-rpc/assets.ts#L96C11-L96C28Issue Tracking
• https://github.com/nuxt/devtools/blob/c4f2b68281203fc3f61ffc97d9c6623fbfde46bb/packages/devtools/src/server-rpc/index.ts#L109Issue Tracking
• https://github.com/nuxt/nuxt/security/advisories/GHSA-rcvg-rgf7-pppvExploit, Third Party Advisory
• https://portswigger.net/web-security/websockets/cross-site-websocket-hijackingThird Party Advisory

Published

Aug 5, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-23651BuildKit is a toolkit for converting source code to build ar…7.4
• CVE-2024-23652BuildKit is a toolkit for converting source code to build ar…9.1
• CVE-2024-23653BuildKit is a toolkit for converting source code to build ar…9.8
• CVE-2024-23654discourse-ai is the AI plugin for the open-source discussion…7.2
• CVE-2024-23655Tuta is an encrypted email service. Starting in version 3.11…5.3
• CVE-2024-23656Dex is an identity service that uses OpenID Connect to drive…7.5
• CVE-2024-23658In camera driver, there is a possible use after free due to …4.4
• CVE-2024-23659SPIP before 4.1.14 and 4.2.x before 4.2.8 allows XSS via the…6.1
• CVE-2024-2366A remote code execution vulnerability exists in the parisneo…9
• CVE-2024-23660The Binance Trust Wallet app for iOS in commit 3cd6e8f647fbb…7.5
• CVE-2024-23662An exposure of sensitive information to an unauthorized acto…7.5
• CVE-2024-23663An improper access control in Fortinet FortiExtender 4.1.1 -…8.8