Wheels Cli
Monthly
Reload-password and code disclosure, plus unintended state-changing operations against a foreign local server, affect developers using the Wheels CLI through 4.1.0. Because the CLI never verifies that the local development server it contacts on a targeted port actually belongs to the current project, any process listening on that port - or, for `wheels console`, on one of the common ports it probes when the project's own server is down - can capture the reload password and code sent via `wheels reload` or `wheels console`, while other commands can be induced to perform state-changing operations against another local application's server and database. Exploitation is local only (CVSS AV:L, PR:L, UI:R) and requires the developer to actively run an affected command, making this a genuine but bounded developer-workstation risk rather than a mass-exploitation priority; no public exploit was identified at time of analysis, and the vendor addresses the flaw in 4.1.1.
Reload-password and code disclosure, plus unintended state-changing operations against a foreign local server, affect developers using the Wheels CLI through 4.1.0. Because the CLI never verifies that the local development server it contacts on a targeted port actually belongs to the current project, any process listening on that port - or, for `wheels console`, on one of the common ports it probes when the project's own server is down - can capture the reload password and code sent via `wheels reload` or `wheels console`, while other commands can be induced to perform state-changing operations against another local application's server and database. Exploitation is local only (CVSS AV:L, PR:L, UI:R) and requires the developer to actively run an affected command, making this a genuine but bounded developer-workstation risk rather than a mass-exploitation priority; no public exploit was identified at time of analysis, and the vendor addresses the flaw in 4.1.1.