Executive brief
Vite is a popular build tool and development server used by web developers. An attacker can bypass directory access restrictions by using URL-encoded path traversal sequences, allowing them to read arbitrary files on the server hosting the Vite development environment. This could expose sensitive files like configuration files, environment variables, or system files if Vite is running on a machine with sensitive data.
Technical details
The vulnerability is a path traversal (CWE-22) in Vite's @fs URL handler. The root cause is insufficient path validation: while Vite checks for directory traversal using literal `../` sequences against a whitelist, it fails to decode URL-encoded characters such as `%2e%2e%2f` (which represents `../`) before performing the check. An attacker can craft a URL like `/@fs/allowed-path/%2e%2e%2f%2e%2e%2fetc%2fhosts` to traverse outside the intended directory. The attack requires network access to the Vite development server (typically running on localhost or a network-accessible port) but no authentication. By sending specially crafted requests using tools like curl with `--path-as-is`, an attacker can read arbitrary files on the host system. Fixed in Vite v2.9.13 and v3.0.0-beta.4 or later.
Affected products
- Vite Vite before v2.9.13 and v3.0.0-alpha.0 through v3.0.0-beta.3
Timeline
- 2022-08-19: disclosed
- 2022-08-19: patched: Fixed in v2.9.13 and v3.0.0-beta.4