Nuxt开发模式下未授权RCE漏洞（CVE-2023-3224）

### Description Nuxt contains a test-component-wrapper component. This is used to mount a single component for testing. This component has a dynamic import function which accepts arbitrary user input on the server side. This pattern will almost always lead to an RCE bug. ### Requirements & Notes The server must be running on dev, this does not work in production modes. I'm not entirely sure if this component is included in the production bundle, but this is an incredibly high-risk component. We can use the EMCAScript 'data: import' feature to make payloads easy, this is only possible on nodejs 12+. ### Proof of Concept Start server with pnpm dev. Navigate to http://localhost:3000/__nuxt_component_test__/?path=data%3Atext%2Fjavascript%2Cconsole%2Elog%28%22hello%21%22%29%3B Observe hello! in output to console. Other possible exploits It may be possible to import a gadget from node_modules or other locations for an exploit if ‘data:’ method is not possible. ### Impact Remote code execution on development servers.