CVE-2024-23331: Vite dev server fs.deny bypass via case-insensitive filesystem

CVE-2024-23331 · Severity: low · CVSS 3.1 · Published 2024-01-19

Vite is a popular build tool and development server used by JavaScript developers. The server's file access restriction setting (`server.fs.deny`) can be bypassed on Windows and other case-insensitive filesystems by requesting files with altered letter casing. An attacker with network access to a dev server can read sensitive files like environment configuration, private keys, and secrets that should be protected.

Technologies: Vite. Vendors: Vite.

Quick answers

Is CVE-2024-23331 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2024-23331 being exploited in the wild.
How severe is CVE-2024-23331?
Low severity, with a CVSS score of 3.1, published 19 January 2024.
Which products and versions are affected?
Vite >=2.7.0 <=2.9.16, >=3.0.0 <=3.2.7, >=4.0.0 <=4.5.1, >=5.0.0 <=5.0.11.
Is there a fix for CVE-2024-23331?
A patch was published on 2024-01-19: Fixed in vite 2.9.17, 3.2.8, 4.5.2, 5.0.12 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-23331 attacked?
It is attacked over the network.
Am I affected by CVE-2024-23331?
Check whether you run Vite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a case-sensitivity bypass in file access control (CWE-178, CWE-284, CWE-200). Vite's picomatch glob matcher defaults to case-sensitive matching, but the underlying filesystem on Windows is case-insensitive, creating a mismatch. An attacker can request files using case-augmented paths (e.g., `/custom.sEcReT` instead of `/custom.secret`) to bypass the `server.fs.deny` blacklist. No authentication is required; the attack is network-accessible on exposed dev servers. An attacker gains read access to restricted files including configuration, environment variables, and private keys. Patches are available in vite 2.9.17, 3.2.8, 4.5.2, and 5.0.12.

Affected products

  • Vite Vite >=2.7.0 <=2.9.16, >=3.0.0 <=3.2.7, >=4.0.0 <=4.5.1, >=5.0.0 <=5.0.11

Identifiers

  • CVE-2024-23331
  • GHSA-c24v-8rfc-w8vw

Timeline

  • 2024-01-19: disclosed
  • 2024-01-19: patched: Fixed in vite 2.9.17, 3.2.8, 4.5.2, 5.0.12

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.