weinre - Security

About security for weinre: there is none.

Obviously there should be some. The question is, what do we need to do?

Background and potential exposures

Currently weinre uses plain old HTTP - not HTTPS - and provides no level of authentication for requests.

The primary security exposure with weinre is via the debug server.

Currently, the server only reads files from the weinre-node distribution, and from the ~/.weinre/ directory (for property files). The only thing the server writes to is stdout and stderr.

If you use the default --boundHost option value of localhost, then any software on the machine running the debug server can communicate with the debug server. This probably isn't a big deal, since presumably you control the software running on that machine.

If you use a non-default --boundHost option value, then any software on any machine that can access that specified host can communicate with the debug server. This is a much bigger deal.

The most obvious exposure with using --boundHost and a specific hostname / ip address, is that any debug client or debug target that can access that hostname / ip address can access the server. For example, a rogue debug client could connect to your debug target and fiddle about with it.

Other exposures include leaving a debug target injection script line (ie, <script src="[...]/target/target-script.js">) in your web page, and then that web page connects to a rogue debug server running at that address.

Future Implementation Ideas

• Let's chat