Description (CNA)
Vite is a frontend tooling framework for JavaScript. From 7.1.0 to before 7.3.2 and 8.0.5, on the Vite dev server, files that should be blocked by server.fs.deny (e.g., .env, *.crt) can be retrieved with HTTP 200 responses when query parameters such as ?raw, ?import&raw, or ?import&url&inline are appended. This vulnerability is fixed in 7.3.2 and 8.0.5.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| vitejs / vite | affected >= 8.0.0, < 8.0.5; affected >= 7.1.0, < 7.3.2 |
| vitejs / vite-plus | affected < 0.1.16 |
CWE
CWE-180, CWE-284
References
ADP enrichment
No English description supplied.
No references supplied.
A flaw was found in Vite, a frontend tooling framework for JavaScript. On the Vite development server, a remote attacker could exploit this vulnerability by appending specific query parameters, such as ?raw, to requests. This allows the attacker to bypass security restrictions and retrieve sensitive files, including environment variables (.env) and certificate files (*.crt), which should otherwise be blocked. This information disclosure could lead to further compromise of the system.