Vite bypasses server.fs.deny when using `?raw??`
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 4.5.10, 5.4.15, 6.0.12, 6.1.2, 6.2.3
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- 1 on Exploit-DB, 25 proofs of concept on GitHub, 1 Nuclei template
- Exploitation: poc
- Automatable: no
- Technical impact: partial
Summary
Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. `@fs` denies access to files outside of Vite serving allow list. Adding `?raw??` or `?import&raw??` to the URL bypasses this limitation and returns the file content if it exists. This bypass exists because trailing separators such as `?` are removed in several places, but are not accounted for in query string regexes. The contents of arbitrary files can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network (using `--host` or `server.host` config option) are affected. Versions 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10 fix the issue.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: poc · Automatable: no · Technical impact: partial
- Record last updated
- Public exploit on Exploit-DB
EDB-52111
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- vitejs vite
fixed in 4.5.10; From 5.0.0 · fixed in 5.4.15; From 6.0.0 · fixed in 6.0.12; From 6.1.0 · fixed in 6.1.2; From 6.2.0 · fixed in 6.2.3
- vitenpm
From 6.2.0 · fixed in 6.2.3
- vitenpm
From 6.1.0 · fixed in 6.1.2
- vitenpm
From 6.0.0 · fixed in 6.0.12
- vitenpm
From 5.0.0 · fixed in 5.4.15
- vitenpm
fixed in 4.5.10