CVE-2023-34092: Vite security bypass in server.fs.deny via double forward-slash

CVE-2023-34092 · Severity: low · CVSS 3.1 · Published 2023-06-06

Vite is a popular development tool used by programmers to build and preview web applications. A security flaw was found where the tool's built-in protections for sensitive files (like environment variables or security certificates) could be bypassed if the development server was shared over a network. This could allow an unauthorized person to read sensitive configuration files from the project's root folder, potentially leading to the exposure of API keys or other credentials.

Quick answers

Is CVE-2023-34092 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2023-34092 being exploited in the wild.
How severe is CVE-2023-34092?
Low severity, with a CVSS score of 3.1, published 6 June 2023.
Which products and versions are affected?
Vitejs Vite < 2.9.16, >= 3.0.2 < 3.2.7, >= 4.0.0 < 4.0.5, >= 4.1.0 < 4.1.5, >= 4.2.0 < 4.2.3, >= 4.3.0 < 4.3.9.
Is there a fix for CVE-2023-34092?
A patch was published on 2023-05-26: Fix merged into main branch via PR #13348 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-34092 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2023-34092?
Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path equivalence vulnerability exists in the Vite development server's file system restriction logic. The 'server.fs.deny' configuration, which is intended to block access to sensitive files like .env or .pem files, can be bypassed by requesting a file with a leading double forward-slash (e.g., '//.env'). This occurs because the server fails to properly normalize or validate paths containing multiple leading slashes before checking them against the denial list. This vulnerability is only exploitable if the Vite dev server is explicitly exposed to the network (e.g., via the --host flag). Attackers can gain unauthenticated read access to any file in the immediate project root. The issue is fixed in versions 2.9.16, 3.2.7, 4.0.5, 4.1.5, 4.2.3, and 4.3.9.

Affected products

  • Vitejs Vite < 2.9.16, >= 3.0.2 < 3.2.7, >= 4.0.0 < 4.0.5, >= 4.1.0 < 4.1.5, >= 4.2.0 < 4.2.3, >= 4.3.0 < 4.3.9

Identifiers

  • CVE-2023-34092
  • GHSA-353f-5xf4-qw67

Timeline

  • 2023-05-26: patched: Fix merged into main branch via PR #13348
  • 2023-06-01: advisory: NVD and GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.