Vulnerability: Missing Origin Validation in webpack-dev-server Versions of `webpack-dev-server` before 3.1.10 are missing origin validation on the websocket server. This vulnerability allows a remote attacker to steal a developer's source code because the origin of requests to the websocket server that is used for Hot Module Replacement (HMR) are not validated.


## Recommendation
For `webpack-dev-server` update to version 3.1.11 or later.
Vulnerability ID: GHSA-cf66-xwfp-gvc4
CWE: CWE-20
Severity score: 7.5
Project: https://github.com/webpack/webpack-dev-server
Published: 2019-01-04
File: lib/Server.js
Commit message: check origin header for websocket connection
Commit author: Tobias Koppers

Vulnerable version (before fix):
 Server.prototype.setContentHeaders = function (req, res, next) {   next(); };  Server.prototype.checkHost = function (headers) {   // allow user to opt-out this security check, at own risk   if (this.disableHostCheck) return true;    // get the Host header and extract hostname   // we don't care about port not matching   const hostHeader = headers.host;   if (!hostHeader) return false;    // use the node url-parser to retrieve the hostname from the host-header. Server.prototype.listen = function (port, hostname, fn) {         conn.close();         return;       }       this.sockets.push(conn);        conn.on('close', () => {

Fixed version (after fix):
 Server.prototype.setContentHeaders = function (req, res, next) {   next(); };  Server.prototype.checkHost = function (headers, headerToCheck) {   // allow user to opt-out this security check, at own risk   if (this.disableHostCheck) return true;    if (!headerToCheck) headerToCheck = "host";    // get the Host header and extract hostname   // we don't care about port not matching   const hostHeader = headers[headerToCheck];   if (!hostHeader) return false;    // use the node url-parser to retrieve the hostname from the host-header. Server.prototype.listen = function (port, hostname, fn) {         conn.close();         return;       }       if (!this.checkHost(conn.headers, "origin")) {         this.sockWrite([conn], 'error', 'Invalid Origin header');         conn.close();         return;       }       this.sockets.push(conn);        conn.on('close', () => {

Patch:
patch: @@ -513,13 +513,15 @@ Server.prototype.setContentHeaders = function (req, res, next) {
   next();
 };
 
-Server.prototype.checkHost = function (headers) {
+Server.prototype.checkHost = function (headers, headerToCheck) {
   // allow user to opt-out this security check, at own risk
   if (this.disableHostCheck) return true;
 
+  if (!headerToCheck) headerToCheck = "host";
+
   // get the Host header and extract hostname
   // we don't care about port not matching
-  const hostHeader = headers.host;
+  const hostHeader = headers[headerToCheck];
   if (!hostHeader) return false;
 
   // use the node url-parser to retrieve the hostname from the host-header.
@@ -589,6 +591,11 @@ Server.prototype.listen = function (port, hostname, fn) {
         conn.close();
         return;
       }
+      if (!this.checkHost(conn.headers, "origin")) {
+        this.sockWrite([conn], 'error', 'Invalid Origin header');
+        conn.close();
+        return;
+      }
       this.sockets.push(conn);
 
       conn.on('close', () => {
path: lib/Server.js