Headline
GHSA-93m4-6634-74q7: vite allows server.fs.deny bypass via backslash on Windows
Summary
Files denied by server.fs.deny were sent if the URL ended with \ when the dev server is running on Windows.
Impact
Only apps that match the following conditions are affected:
- explicitly exposes the Vite dev server to the network (using --host or
server.hostconfig option) - running the dev server on Windows
Details
server.fs.deny can contain patterns matching against files (by default it includes .env, .env.*, *.{crt,pem} as such patterns). These patterns were able to bypass by using a back slash(\). The root cause is that fs.readFile('/foo.png/') loads /foo.png.
PoC
npm create vite@latest
cd vite-project/
cat "secret" > .env
npm install
npm run dev
curl --request-target /.env\ http://localhost:5173
<img width="1593" height="616" alt="image" src="https://github.com/user-attachments/assets/36212f4e-1d3c-4686-b16f-16b35ca9e175" />
Summary
Files denied by server.fs.deny were sent if the URL ended with \ when the dev server is running on Windows.
Impact
Only apps that match the following conditions are affected:
- explicitly exposes the Vite dev server to the network (using --host or server.host config option)
- running the dev server on Windows
Details
server.fs.deny can contain patterns matching against files (by default it includes .env, .env.*, *.{crt,pem} as such patterns). These patterns were able to bypass by using a back slash(). The root cause is that fs.readFile(‘/foo.png/’) loads /foo.png.
PoC
npm create vite@latest cd vite-project/ cat “secret” > .env npm install npm run dev curl --request-target /.env\ http://localhost:5173
### References - https://github.com/vitejs/vite/security/advisories/GHSA-93m4-6634-74q7 - https://github.com/vitejs/vite/commit/f479cc57c425ed41ceb434fecebd63931b1ed4ed