Is CVE-2024-31207 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-31207 being exploited in the wild.

How severe is CVE-2024-31207?

Low severity, with a CVSS score of 3.1, published 3 April 2024.

Which products and versions are affected?

Vite 2.7.0 through 2.9.17, 3.0.0 through 3.2.8, 4.0.0 through 4.5.2, 5.0.0 through 5.0.12, 5.1.0 through 5.1.6, 5.2.0 through 5.2.5.

Is there a fix for CVE-2024-31207?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2024-31207 attacked?

It is attacked over the network.

Am I affected by CVE-2024-31207?

Check whether you run Vite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-31207: Vite server.fs.deny bypass with directory patterns

CVE-2024-31207 · Severity: low · CVSS 3.1 · Published 2024-04-03

Vite is a JavaScript build tool widely used by developers to build modern web applications. When developers configure file access restrictions using the server.fs.deny option, these restrictions could be bypassed if patterns include directory paths (such as blocking "**/.git/**"). An attacker who can reach a developer's Vite dev server exposed to the network could exploit this to read sensitive files like Git configuration or other protected resources that should be blocked.

Technologies: Vite. Vendors: Vite.

Quick answers

Is CVE-2024-31207 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-31207 being exploited in the wild.
How severe is CVE-2024-31207?: Low severity, with a CVSS score of 3.1, published 3 April 2024.
Which products and versions are affected?: Vite 2.7.0 through 2.9.17, 3.0.0 through 3.2.8, 4.0.0 through 4.5.2, 5.0.0 through 5.0.12, 5.1.0 through 5.1.6, 5.2.0 through 5.2.5.
Is there a fix for CVE-2024-31207?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2024-31207 attacked?: It is attacked over the network.
Am I affected by CVE-2024-31207?: Check whether you run Vite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is an access control bypass in Vite's server.fs.deny configuration feature. The root cause lies in Vite's use of picomatch with the matchBase flag set to true, which only matches against file basenames rather than full paths. When developers specify deny patterns with directories (e.g., "**/.git/**"), the pattern matching fails to properly evaluate the directory structure, allowing requests to files within restricted directories to succeed. The vulnerability requires (1) custom server.fs.deny configuration with directory-based patterns and (2) the Vite dev server exposed to the network (via --host or server.host config). Attackers can read sensitive files by crafting requests to paths that should be denied. Patches are available in Vite 2.9.18, 3.2.10, 4.5.3, 5.0.13, 5.1.7, and 5.2.6.

Affected products

Vite Vite 2.7.0 through 2.9.17, 3.0.0 through 3.2.8, 4.0.0 through 4.5.2, 5.0.0 through 5.0.12, 5.1.0 through 5.1.6, 5.2.0 through 5.2.5

Identifiers

CVE-2024-31207
GHSA-8jhw-289h-jh2g

Timeline

2024-04-03: disclosed: CVE-2024-31207 and GHSA-8jhw-289h-jh2g published

References

https://github.com/vitejs/vite/security/advisories/GHSA-8jhw-289h-jh2g

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.