Listen to this Post
This vulnerability affects Vite’s development server. When the server is explicitly exposed to the network (via `–host` or `server.host` config), a remote attacker can craft specific HTTP requests to read the source code of files that should be restricted. By appending `?inline&import` or `?raw&import` query parameters to a request for a non-public module, the server incorrectly returns the file’s full content. This bypasses Vite’s internal checks that are designed to only serve files from the allowed project directories. The issue occurs due to incorrect order of operations in the request handler, where the validation for allowed paths happens after the logic for processing these specific import query parameters. Consequently, an attacker can leverage this to perform a directory traversal and access sensitive files like configuration files (vite.config.js, .env) or source code not intended for client-side exposure.
Platform: Vite dev server
Version: <4.5.11, <5.4.16, <6.0.13, <6.1.3, <6.2.4
Vulnerability: Arbitrary file read
Severity: Medium
Date: 2024-12-15
Prediction: Patch released 2024-12-15
What Undercode Say:
$ npm list vite my-app@ /projects/app └── [email protected] $ cat vite.config.js export default { server: { host: '0.0.0.0' // Enables network exposure } } $ npx vite --host
How Exploit:
http://target-dev-server:5173/vite.config.js?raw&import http://target-dev-server:5173/../parent/.env?inline&import
Protection from this CVE
- Upgrade to Vite version 4.5.11, 5.4.16, 6.0.13, 6.1.3, 6.2.4 or later.
- Avoid exposing the Vite development server to the network.
- Use firewall rules to restrict access to the dev server port.
Impact:
Confidentiality Impact: High
Integrity Impact: None
Availability Impact: None
Attack Vector: Network
User Interaction: Required
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: www.cve.org
Extra Source Hub:
Undercode
