GHSA-c24v-8rfc-w8vw CVE-2024-23331
Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem
- Severity
- 7.5 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 0.78%
- Chance of exploitation in the next 30 days. Higher than 56.08% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-178 Improper Handling of Case Sensitivity
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
- CWE-284 Improper Access Control
- Fix
2.9.17- Upgrade vite to this version or later
Description
Summary
Vite dev server option server.fs.deny can be bypassed on case-insensitive file systems using case-augmented versions of filenames. Notably this affects servers hosted on Windows.
This bypass is similar to https://nvd.nist.gov/vuln/detail/CVE-2023-34092 -- with surface area reduced to hosts having case-insensitive filesystems.
Patches
Fixed in vite@5.0.12, vite@4.5.2, vite@3.2.8, vite@2.9.17
Details
Since picomatch defaults to case-sensitive glob matching, but the file server doesn't discriminate; a blacklist bypass is possible.
See picomatch usage, where nocase is defaulted to false: https://github.com/vitejs/vite/blob/v5.1.0-beta.1/packages/vite/src/node/server/index.ts#L632
By requesting raw filesystem paths using augmented casing, the matcher derived from config.server.fs.deny fails to block access to sensitive files.
PoC
Setup
- Created vanilla Vite project using
npm create vite@lateston a Standard Azure hosted Windows 10 instance.npm run dev -- --host 0.0.0.0- Publicly accessible for the time being here: http://20.12.242.81:5173/
- Created dummy secret files, e.g.
custom.secretandproduction.pem - Populated
vite.config.jswith
export default { server: { fs: { deny: ['.env', '.env.*', '*.{crt,pem}', 'custom.secret'] } } }
Reproduction
curl -s http://20.12.242.81:5173/@fs//- Descriptive error page reveals absolute filesystem path to project root
curl -s http://20.12.242.81:5173/@fs/C:/Users/darbonzo/Desktop/vite-project/vite.config.js- Discoverable configuration file reveals locations of secrets
curl -s http://20.12.242.81:5173/@fs/C:/Users/darbonzo/Desktop/vite-project/custom.sEcReT- Secrets are directly accessible using case-augmented version of filename
Proof Screenshot 2024-01-19 022736
Impact
Who
- Users with exposed dev servers on environments with case-insensitive filesystems
What
- Files protected by
server.fs.denyare both discoverable, and accessible
Affected versions
npm
| Package | Vulnerable | Fixed in |
|---|---|---|
| vite | >= 2.7.0, < 2.9.17 |
2.9.17 |
| vite | >= 3.0.0, < 3.2.8 |
3.2.8 |
| vite | >= 4.0.0, < 4.5.2 |
4.5.2 |
| vite | >= 5.0.0, < 5.0.12 |
5.0.12 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
vite npm → 2.9.17
- npm
npm install vite@2.9.17- yarn
yarn add vite@2.9.17- pnpm
pnpm add vite@2.9.17
Severity breakdown
CVSS 3.1 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Weakness
CWE-178: Improper Handling of Case Sensitivity
The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.
How to prevent it
- Architecture and Design: Avoid making decisions based on names of resources (e.g. files) if those resources can have alternate names.
- Implementation: Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
- Implementation: Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
How to prevent it
- Architecture and Design: Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
How to prevent it
- Architecture and Design, Operation: Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
- Architecture and Design: Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
References
Advisories
Packages
Other links
- github.com/vitejs/vite/security/advisories/GHSA-c24v-8rfc-w8vw
- github.com/vitejs/vite/commit/0cd769c279724cf27934b1270fbdd45d68217691
- github.com/vitejs/vite/commit/91641c4da0a011d4c5352e88fc68389d4e1289a5
- github.com/vitejs/vite/commit/a26c87d20f9af306b5ce3ff1648be7fa5146c278
- github.com/vitejs/vite/commit/eeec23bbc9d476c54a3a6d36e78455867185a7cb
- vitejs.dev/config/server-options.html
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-4r4m-qw57-chr8 Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query | High Known exploited | Also affects vite |
| GHSA-8g5g-mxqh-grgj Vite: `server.fs.deny` bypassed with queries | Medium | Also affects vite |
| GHSA-vfpm-58rq-9qcg Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance` | Medium | Also affects vite |
| GHSA-rq7h-c2jc-7f22 Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine | Medium | Also affects vite |
| GHSA-9jrq-w75r-8gcw Vite: Cross origin script execution through Vite custom middleware | Low | Also affects vite |
| GHSA-r825-w8mm-5pxw launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors | Medium | Also affects vite |
| GHSA-698v-4r3x-3vcv launch-editor: escapeCmdArgs() omits % escaping on Windows | Medium | Also affects vite |
| GHSA-587h-7wmj-h5pm launch-editor: `fs.existsSync()` existence check can be bypassed on Windows | High | Also affects vite |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor