Quick answers
- Is CVE-2022-35204 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2022-35204 being exploited in the wild.
- How severe is CVE-2022-35204?
- Low severity, with a CVSS score of 3.1, published 19 August 2022.
- Which products and versions are affected?
- Vite before v2.9.13 and v3.0.0-alpha.0 through v3.0.0-beta.3.
- Is there a fix for CVE-2022-35204?
- A patch was published on 2022-08-19: Fixed in v2.9.13 and v3.0.0-beta.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2022-35204 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2022-35204?
- Check whether you run Vite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a path traversal (CWE-22) in Vite's @fs URL handler. The root cause is insufficient path validation: while Vite checks for directory traversal using literal `../` sequences against a whitelist, it fails to decode URL-encoded characters such as `%2e%2e%2f` (which represents `../`) before performing the check. An attacker can craft a URL like `/@fs/allowed-path/%2e%2e%2f%2e%2e%2fetc%2fhosts` to traverse outside the intended directory. The attack requires network access to the Vite development server (typically running on localhost or a network-accessible port) but no authentication. By sending specially crafted requests using tools like curl with `--path-as-is`, an attacker can read arbitrary files on the host system. Fixed in Vite v2.9.13 and v3.0.0-beta.4 or later.
Affected products
- Vite Vite before v2.9.13 and v3.0.0-alpha.0 through v3.0.0-beta.3
Identifiers
- CVE-2022-35204
- GHSA-mv48-hcvh-8jj8
Timeline
- 2022-08-19: disclosed
- 2022-08-19: patched: Fixed in v2.9.13 and v3.0.0-beta.4