CVE-2023-34092 Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)

2023-06-0116:29:51

CWE-50

CWE-200

GitHub_M

www.cve.org

vite

security vulnerability

unauthenticated

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.001

Percentile

50.6%

JSON

Vite provides frontend tooling. Prior to versions 2.9.16, 3.2.7, 4.0.5, 4.1.5, 4.2.3, and 4.3.9, Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//) allows any unauthenticated user to read file from the Vite root-path of the application including the default fs.deny settings (['.env', '.env.*', '*.{crt,pem}']). Only users explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected, and only files in the immediate Vite project root folder could be exposed. This issue is fixed in [email protected], [email protected], [email protected], [email protected], [email protected], and [email protected].

CNA Affected

[
  {
    "vendor": "vitejs",
    "product": "vite",
    "versions": [
      {
        "version": "< 2.9.16",
        "status": "affected"
      },
      {
        "version": ">= 3.0.2, < 3.2.7",
        "status": "affected"
      },
      {
        "version": ">= 4.0.0, < 4.0.5",
        "status": "affected"
      },
      {
        "version": ">= 4.1.0, < 4.1.5",
        "status": "affected"
      },
      {
        "version": ">= 4.2.0, < 4.2.3",
        "status": "affected"
      },
      {
        "version": ">= 4.3.0, < 4.3.9",
        "status": "affected"
      }
    ]
  }
]