Junglewise Threat Intelligence

CVE-2025-59427: Cloudflare Vite plugin information disclosure via dev server

CVE-2025-59427 · Severity: medium · CVSS 4 · Published 2025-07-08

Vendors: Cloudflare, npm.

Executive brief

The Cloudflare Vite plugin, used by developers building Cloudflare Workers applications, serves all project files—including sensitive configuration files like .env and .dev.vars—via its built-in development server by default. If a developer exposes this dev server on a public network (either intentionally or accidentally via tools like cloudflared tunnels), attackers on that network can directly access secret credentials and internal documentation, potentially gaining unauthorized access to cloud services and third-party APIs.

Technical details

This is an information disclosure vulnerability (CWE-200) in the Cloudflare Vite plugin where the development server's static file serving is misconfigured. The root cause is that Vite's default configuration serves files from the project root directory, not just from the assets directory; the plugin does not restrict access to sensitive files like .env, .dev.vars, and .dev.vars.* variants. An unauthenticated attacker with network access to the dev server (accessible locally, on a shared network, or via a public tunnel like cloudflared) can trivially enumerate and retrieve these files via HTTP GET requests (e.g., curl http://target:5173/.env). The attack requires no authentication, user interaction, or special preconditions beyond network reachability. Successful exploitation discloses API keys, database credentials, and other secrets that enable lateral movement and unauthorized cloud service access. The vulnerability affects all versions prior to 1.6.0; the fix restricts access to .dev.vars files in the dev and preview servers.

Affected products

  • Cloudflare @cloudflare/vite-plugin <1.6.0

Timeline

  • 2025-07-08: disclosed
  • 2025-06-11: patched: Patch commit dated 2025-06-11; version 1.6.0 released with fix
  • 2025-07-08: advisory: GHSA-4pfg-2mw5-f8jx published

References