Executive brief
Vite is a popular build tool and development server used by JavaScript developers. The server's file access restriction setting (`server.fs.deny`) can be bypassed on Windows and other case-insensitive filesystems by requesting files with altered letter casing. An attacker with network access to a dev server can read sensitive files like environment configuration, private keys, and secrets that should be protected.
Technical details
The vulnerability is a case-sensitivity bypass in file access control (CWE-178, CWE-284, CWE-200). Vite's picomatch glob matcher defaults to case-sensitive matching, but the underlying filesystem on Windows is case-insensitive, creating a mismatch. An attacker can request files using case-augmented paths (e.g., `/custom.sEcReT` instead of `/custom.secret`) to bypass the `server.fs.deny` blacklist. No authentication is required; the attack is network-accessible on exposed dev servers. An attacker gains read access to restricted files including configuration, environment variables, and private keys. Patches are available in vite 2.9.17, 3.2.8, 4.5.2, and 5.0.12.
Affected products
- Vite Vite >=2.7.0 <=2.9.16, >=3.0.0 <=3.2.7, >=4.0.0 <=4.5.1, >=5.0.0 <=5.0.11
Timeline
- 2024-01-19: disclosed
- 2024-01-19: patched: Fixed in vite 2.9.17, 3.2.8, 4.5.2, 5.0.12