Headline
GHSA-353f-5xf4-qw67: Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)
Summary
Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//) allows any unauthenticated user to read file from the Vite root-path of the application including the default fs.deny settings (['.env', '.env.*', '*.{crt,pem}'])
Impact
Only users explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected, and only files in the immediate Vite project root folder could be exposed.
Patches
Fixed in vite@4.3.9, vite@4.2.3, vite@4.1.5, vite@4.0.5 And in the latest minors of the previous two majors: vite@3.2.7, vite@2.9.16
Details
Vite serve the application with under the root-path of the project while running on the dev mode. By default, vite using server options fs.deny to protected the sensitive information of the file. But, with simply double forward-slash, we can bypass this fs restriction.
PoC
- Create a new latest project of vite using any package manager. (here I’m using react and vue templates for tested and pnpm)
- Serve the application on dev mode using pnpm run dev.
- Directly access the file from url using double forward-slash (
//) (e.g://.env,//.env.local) - Server Options
fs.denyrestrict successfully bypassed.
Proof Images:
Summary
Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//) allows any unauthenticated user to read file from the Vite root-path of the application including the default fs.deny settings (['.env’, ‘.env.', '.{crt,pem}’])
Impact
Only users explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected, and only files in the immediate Vite project root folder could be exposed.
Patches
Fixed in vite@4.3.9, vite@4.2.3, vite@4.1.5, vite@4.0.5
And in the latest minors of the previous two majors: vite@3.2.7, vite@2.9.16
Details
Vite serve the application with under the root-path of the project while running on the dev mode. By default, vite using server options fs.deny to protected the sensitive information of the file. But, with simply double forward-slash, we can bypass this fs restriction.
PoC
- Create a new latest project of vite using any package manager. (here I’m using react and vue templates for tested and pnpm)
- Serve the application on dev mode using pnpm run dev.
- Directly access the file from url using double forward-slash (//) (e.g: //.env, //.env.local)
- Server Options fs.deny restrict successfully bypassed.
Proof Images:
References
- GHSA-353f-5xf4-qw67
- https://nvd.nist.gov/vuln/detail/CVE-2023-34092
- vitejs/vite#13348
- vitejs/vite@813ddd6
Related news
Vite provides frontend tooling. Prior to versions 2.9.16, 3.2.7, 4.0.5, 4.1.5, 4.2.3, and 4.3.9, Vite Server Options (`server.fs.deny`) can be bypassed using double forward-slash (//) allows any unauthenticated user to read file from the Vite root-path of the application including the default `fs.deny` settings (`['.env', '.env.*', '*.{crt,pem}']`). Only users explicitly exposing the Vite dev server to the network (using `--host` or `server.host` config option) are affected, and only files in the immediate Vite project root folder could be exposed. This issue is fixed in vite@4.3.9, vite@4.2.3, vite@4.1.5, vite@4.0.5, vite@3.2.7, and vite@2.9.16.