{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/rspack/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["@rsdoctor/rspack-plugin (\u003c= 1.5.11)"],"_cs_severities":["high"],"_cs_tags":["information-disclosure","supply-chain","developer-tools"],"_cs_type":"advisory","_cs_vendors":["Rspack"],"content_html":"\u003cp\u003eThe \u003ccode\u003e@rsdoctor/rspack-plugin\u003c/code\u003e (up to version 1.5.11) contains a critical information disclosure vulnerability caused by the default behavior of its internal HTTP report server. By default, the server binds to \u003ccode\u003e0.0.0.0\u003c/code\u003e (all network interfaces) and enables a \u003ccode\u003ePOST /api/data/key\u003c/code\u003e endpoint without any authentication mechanism. Furthermore, the SDK applies a wildcard CORS policy, allowing cross-origin requests from any source.\u003c/p\u003e\n\u003cp\u003eWhen a developer runs a build using this plugin, the server starts automatically in non-CI environments. Any network-adjacent attacker can perform a single unauthenticated HTTP POST request to this server to retrieve sensitive build artifacts, including the full JavaScript source code of all compiled modules (\u003ccode\u003emoduleCodeMap\u003c/code\u003e), absolute file paths, and build configuration details (\u003ccode\u003econfigs\u003c/code\u003e). This vulnerability is particularly dangerous for developers on shared networks, VPNs, or those running the plugin in environments accessible via local networks. The vulnerability is resolved in version 1.5.16, which mandates binding to \u003ccode\u003e127.0.0.1\u003c/code\u003e and restricts CORS origins.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a target developer machine running a build process with \u003ccode\u003e@rsdoctor/rspack-plugin\u003c/code\u003e on a shared network (e.g., VPN or local Wi-Fi).\u003c/li\u003e\n\u003cli\u003eThe Rsdoctor SDK server initializes and binds to \u003ccode\u003e0.0.0.0\u003c/code\u003e on a dynamic port, making it reachable by any device on the local network.\u003c/li\u003e\n\u003cli\u003eAttacker discovers the active port via network scanning or by observing traffic from the target device.\u003c/li\u003e\n\u003cli\u003eAttacker sends a malicious, unauthenticated HTTP POST request to \u003ccode\u003ehttp://\u0026lt;victim-lan-ip\u0026gt;:\u0026lt;port\u0026gt;/api/data/key\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe server's \u003ccode\u003eloadDataByKey\u003c/code\u003e method accepts the user-supplied \u003ccode\u003ekey\u003c/code\u003e from the request body without validation or authentication.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ebase.ts\u003c/code\u003e handler uses the attacker-controlled \u003ccode\u003ekey\u003c/code\u003e to index the internal SDK data store, including traversal of nested keys.\u003c/li\u003e\n\u003cli\u003eThe system serializes the requested sensitive data (e.g., \u003ccode\u003emoduleCodeMap\u003c/code\u003e) and returns the full content of the source code or build configuration to the attacker.\u003c/li\u003e\n\u003cli\u003eThe attacker parses the JSON response to harvest proprietary source code, credentials, or file structure information.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation leads to the complete disclosure of project source code and build environment metadata. This includes hardcoded API keys, proprietary business logic, absolute filesystem paths, and environment variables contained within the build process. Impacted parties include individual developers and enterprise organizations where developers run local builds on semi-trusted or shared networks.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade \u003ccode\u003e@rsdoctor/rspack-plugin\u003c/code\u003e to version 1.5.16 or later immediately.\u003c/li\u003e\n\u003cli\u003eImplement network segmentation to ensure build processes on developer machines are not reachable by unauthorized devices on the local network.\u003c/li\u003e\n\u003cli\u003eAudit developer workstations for rogue HTTP services running on all interfaces (0.0.0.0) that lack authentication.\u003c/li\u003e\n\u003cli\u003eUse firewall rules to restrict inbound connections to build-related ports to \u003ccode\u003elocalhost\u003c/code\u003e (127.0.0.1) until all projects are patched.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-24T20:05:06Z","date_published":"2026-09-24T20:05:06Z","id":"https://feed.craftedsignal.io/briefs/2026-09-rsdoctor-unauth-api/","summary":"The @rsdoctor/rspack-plugin binds its report server to all network interfaces with no authentication, allowing attackers to exfiltrate source code and build metadata via an unauthenticated POST request.","title":"Unauthenticated Information Disclosure in @rsdoctor/rspack-plugin","url":"https://feed.craftedsignal.io/briefs/2026-09-rsdoctor-unauth-api/"}],"language":"en","title":"CraftedSignal Threat Feed - Rspack","version":"https://jsonfeed.org/version/1.1"}