Executive brief
Vite is a JavaScript build tool widely used by developers to build modern web applications. When developers configure file access restrictions using the server.fs.deny option, these restrictions could be bypassed if patterns include directory paths (such as blocking "**/.git/**"). An attacker who can reach a developer's Vite dev server exposed to the network could exploit this to read sensitive files like Git configuration or other protected resources that should be blocked.
Technical details
This vulnerability is an access control bypass in Vite's server.fs.deny configuration feature. The root cause lies in Vite's use of picomatch with the matchBase flag set to true, which only matches against file basenames rather than full paths. When developers specify deny patterns with directories (e.g., "**/.git/**"), the pattern matching fails to properly evaluate the directory structure, allowing requests to files within restricted directories to succeed. The vulnerability requires (1) custom server.fs.deny configuration with directory-based patterns and (2) the Vite dev server exposed to the network (via --host or server.host config). Attackers can read sensitive files by crafting requests to paths that should be denied. Patches are available in Vite 2.9.18, 3.2.10, 4.5.3, 5.0.13, 5.1.7, and 5.2.6.
Affected products
- Vite Vite 2.7.0 through 2.9.17, 3.0.0 through 3.2.8, 4.0.0 through 4.5.2, 5.0.0 through 5.0.12, 5.1.0 through 5.1.6, 5.2.0 through 5.2.5
Timeline
- 2024-04-03: disclosed: CVE-2024-31207 and GHSA-8jhw-289h-jh2g published