Executive brief
Vite is a popular development tool used by programmers to build and preview web applications. A security flaw was found where the tool's built-in protections for sensitive files (like environment variables or security certificates) could be bypassed if the development server was shared over a network. This could allow an unauthorized person to read sensitive configuration files from the project's root folder, potentially leading to the exposure of API keys or other credentials.
Technical details
A path equivalence vulnerability exists in the Vite development server's file system restriction logic. The 'server.fs.deny' configuration, which is intended to block access to sensitive files like .env or .pem files, can be bypassed by requesting a file with a leading double forward-slash (e.g., '//.env'). This occurs because the server fails to properly normalize or validate paths containing multiple leading slashes before checking them against the denial list. This vulnerability is only exploitable if the Vite dev server is explicitly exposed to the network (e.g., via the --host flag). Attackers can gain unauthenticated read access to any file in the immediate project root. The issue is fixed in versions 2.9.16, 3.2.7, 4.0.5, 4.1.5, 4.2.3, and 4.3.9.
Affected products
- Vitejs Vite < 2.9.16, >= 3.0.2 < 3.2.7, >= 4.0.0 < 4.0.5, >= 4.1.0 < 4.1.5, >= 4.2.0 < 4.2.3, >= 4.3.0 < 4.3.9
Timeline
- 2023-05-26: patched: Fix merged into main branch via PR #13348
- 2023-06-01: advisory: NVD and GitHub Advisory published