CVE-2024-34344

Executive Summary

CVE-2024-34344 is a critical vulnerability in the Nuxt framework (a Vue.js-based full-stack web application framework) that allows remote code execution (RCE) via insufficient validation of the path parameter in the NuxtTestComponentWrapper. An attacker can craft a malicious web page that, when opened by a developer running Nuxt tests locally, sends crafted requests to the test server, leading to arbitrary JavaScript execution on the server side. This can be chained to execute arbitrary system commands. The vulnerability has a CVSS score of 8.8 (High) and currently has no known patch or public exploit code.

Supply Chain & Package Security

Nuxt is an open-source framework distributed via npm. This vulnerability affects the test infrastructure of Nuxt projects. Developers who run nuxt test locally are at risk if they visit a malicious web page while the test server is running. The attack does not require authentication and can be triggered repeatedly by a remote attacker. Since no patch is available, users must implement mitigations such as restricting network access to the test server or avoiding browsing untrusted sites during testing.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack is launched over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – The victim must open a malicious web page.
• Scope (S): Unchanged (U) – The vulnerable component and the attacker’s target are the same.
• Confidentiality Impact (C): High (H) – Full system compromise possible.
• Integrity Impact (I): High (H) – Arbitrary code execution.
• Availability Impact (A): High (H) – Potential denial of service or system takeover.

Threat Level: High – Exploitation is straightforward if a developer visits a malicious site while tests are running.

Deep Dive & Mechanics

The vulnerability resides in the NuxtTestComponentWrapper, a component used during Nuxt’s test suite. The path parameter is not properly sanitized, allowing an attacker to inject arbitrary JavaScript code. When the test server processes a request with a malicious path, the injected code is executed on the server side. This is a classic injection vulnerability (CWE-20: Improper Input Validation).

The attack flow:

1. A developer runs nuxt test locally, starting a test server (typically on localhost:3000 or similar).
2. The developer visits a malicious web page (e.g., via phishing or drive-by download).
3. The malicious page sends a crafted HTTP request to the test server with a malicious path parameter.
4. The server processes the request without proper validation, executing the injected JavaScript.
5. The attacker can then execute arbitrary commands on the developer’s machine.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// NuxtTestComponentWrapper.vue (vulnerable)
export default {
  props: {
    path: {
      type: String,
      required: true
    }
  },
  mounted() {
    // Directly using path without sanitization
    const result = eval(`require('${this.path}')`);
  }
}

Patched Code (Conceptual):

// NuxtTestComponentWrapper.vue (patched)
export default {
  props: {
    path: {
      type: String,
      required: true,
      validator: (value) => {
        // Only allow safe paths
        return /^[a-zA-Z0-9_\/\.-]+$/.test(value);
      }
    }
  },
  mounted() {
    // Use safe dynamic import instead of eval
    import(`./components/${this.path}`).then(module => {
      // Safe usage
    });
  }
}

Exploitation & Lab Setup

Red Team (Attacker)

Lab Setup:

• Target: Developer machine running nuxt test on localhost:3000.
• Attacker: Malicious web page hosted on attacker-controlled server.

Exploit Steps:

1. Host a malicious HTML page that sends a crafted request to the victim’s test server.
2. The request includes a path parameter with JavaScript payload (e.g., require('child_process').execSync('calc.exe')).
3. When the victim opens the page, the request is sent, and the payload executes.

Example Malicious Page:

<!DOCTYPE html>
<html>
<body>
<script>
fetch('http://localhost:3000/__nuxt_test_component_wrapper?path=require("child_process").execSync("calc.exe")');
</script>
</body>
</html>

Blue Team (Defender)

Detection:

• Monitor for unusual requests to __nuxt_test_component_wrapper endpoint.
• Look for path parameters containing require, exec, eval, or other dangerous functions.
• Use network segmentation to isolate test servers from untrusted networks.

Mitigation:

• Do not browse the web while running Nuxt tests.
• Use a dedicated test environment with restricted network access.
• Apply input validation to the path parameter (if source code is accessible).

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to __nuxt_test_component_wrapper with suspicious path parameters.
  • Outbound connections from test server to unknown IPs (if payload exfiltrates data).
• File IOCs:
  • Unexpected files created in the project directory (e.g., reverse shell scripts).
• Process IOCs:
  • Unusual child processes spawned by Node.js (e.g., calc.exe, bash, cmd).

Detection Engineering

YARA Rule

rule CVE_2024_34344_Nuxt_RCE {
  meta:
    description = "Detects malicious requests targeting NuxtTestComponentWrapper path injection"
    author = "Valters IT"
    date = "2025-04-10"
    reference = "CVE-2024-34344"
  strings:
    $s1 = "__nuxt_test_component_wrapper" nocase
    $s2 = "path=" nocase
    $s3 = "require(" nocase
    $s4 = "exec" nocase
    $s5 = "eval" nocase
  condition:
    all of ($s1, $s2) and 1 of ($s3, $s4, $s5)
}

Sigma Rule

title: CVE-2024-34344 Nuxt Test Component Wrapper RCE
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts of CVE-2024-34344 via malicious path parameter
author: Valters IT
logsource:
  category: webserver
  product: nuxt
detection:
  selection:
    cs-method: 'GET'
    cs-uri-query|contains: '__nuxt_test_component_wrapper'
    cs-uri-query|contains: 'path='
  keywords:
    - 'require('
    - 'exec'
    - 'eval'
    - 'child_process'
  condition: selection and keywords
falsepositives:
  - Legitimate test usage with safe paths
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-34344 Nuxt Test Component Wrapper RCE Attempt"; flow:to_server; content:"__nuxt_test_component_wrapper"; http_uri; content:"path="; http_uri; pcre:"/require\(|exec|eval|child_process/i"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Mitigation:

   • Do not browse the web while running nuxt test.
   • Use a firewall to block inbound connections to the test server from untrusted networks.
   • Run tests in an isolated environment (e.g., Docker container with no network access).

2. Long-term Fix:

   • Apply input validation to the path parameter in NuxtTestComponentWrapper.
   • Use safe dynamic imports instead of eval or require with user input.
   • Monitor Nuxt’s official repository for a patch and apply it promptly.

3. Detection:

   • Deploy the provided YARA, Sigma, and Suricata rules to detect exploitation attempts.
   • Enable logging on test servers and review logs for suspicious requests.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert