CVE-2024-23331
Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
Vite is a frontend tooling framework for javascript. The Vite dev server option `server.fs.deny` can be bypassed on case-insensitive file systems using case-augmented versions of filenames. Notably this affects servers hosted on Windows. This bypass is similar to CVE-2023-34092 -- with surface area reduced to hosts having case-insensitive filesystems. Since `picomatch` defaults to case-sensitive glob matching, but the file server doesn't discriminate; a blacklist bypass is possible. By requesting raw filesystem paths using augmented casing, the matcher derived from `config.server.fs.deny` fails to block access to sensitive files. This issue has been addressed in vite@5.0.12, vite@4.5.2, vite@3.2.8, and vite@2.9.17. Users are advised to upgrade. Users unable to upgrade should restrict access to dev servers.
Vite es un framework de herramientas frontend para javascript. La opción del servidor de desarrollo de Vite `server.fs.deny` se puede omitir en sistemas de archivos que no distinguen entre mayúsculas y minúsculas utilizando versiones de nombres de archivos aumentadas entre mayúsculas y minúsculas. Cabe destacar que esto afecta a los servidores alojados en Windows. Esta omisión es similar a CVE-2023-34092, con un área de superficie reducida para hosts que tienen sistemas de archivos que no distinguen entre mayúsculas y minúsculas. Dado que `picomatch` por defecto utiliza coincidencias globales que distinguen entre mayúsculas y minúsculas, pero el servidor de archivos no discrimina; es posible omitir la lista negra. Al solicitar rutas de sistema de archivos sin formato usando mayúsculas aumentadas, el comparador derivado de `config.server.fs.deny` no logra bloquear el acceso a archivos confidenciales. Este problema se ha solucionado en vite@5.0.12, vite@4.5.2, vite@3.2.8 y vite@2.9.17. Se recomienda a los usuarios que actualicen. Los usuarios que no puedan actualizar deben restringir el acceso a los servidores de desarrollo.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2024-01-15 CVE Reserved
- 2024-01-19 CVE Published
- 2024-01-30 EPSS Updated
- 2024-08-01 CVE Updated
- 2024-08-01 First Exploit
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-178: Improper Handling of Case Sensitivity
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
- CWE-284: Improper Access Control
CAPEC
References (3)
| URL | Tag | Source |
|---|---|---|
| https://vitejs.dev/config/server-options.html#server-fs-deny | Product |
| URL | Date | SRC |
|---|---|---|
| https://github.com/vitejs/vite/security/advisories/GHSA-c24v-8rfc-w8vw | 2024-08-01 |
| URL | Date | SRC |
|---|---|---|
| https://github.com/vitejs/vite/commit/91641c4da0a011d4c5352e88fc68389d4e1289a5 | 2024-01-29 |
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Vitejs Search vendor "Vitejs" | Vite Search vendor "Vitejs" for product "Vite" | >= 2.7.0 < 2.9.17 Search vendor "Vitejs" for product "Vite" and version " >= 2.7.0 < 2.9.17" | node.js |
Affected
| in | Microsoft Search vendor "Microsoft" | Windows Search vendor "Microsoft" for product "Windows" | - | - |
Safe
|
| Vitejs Search vendor "Vitejs" | Vite Search vendor "Vitejs" for product "Vite" | >= 3.0.0 < 3.2.8 Search vendor "Vitejs" for product "Vite" and version " >= 3.0.0 < 3.2.8" | node.js |
Affected
| in | Microsoft Search vendor "Microsoft" | Windows Search vendor "Microsoft" for product "Windows" | - | - |
Safe
|
| Vitejs Search vendor "Vitejs" | Vite Search vendor "Vitejs" for product "Vite" | >= 4.0.0 < 4.5.2 Search vendor "Vitejs" for product "Vite" and version " >= 4.0.0 < 4.5.2" | node.js |
Affected
| in | Microsoft Search vendor "Microsoft" | Windows Search vendor "Microsoft" for product "Windows" | - | - |
Safe
|
| Vitejs Search vendor "Vitejs" | Vite Search vendor "Vitejs" for product "Vite" | >= 5.0.0 < 5.0.12 Search vendor "Vitejs" for product "Vite" and version " >= 5.0.0 < 5.0.12" | node.js |
Affected
| in | Microsoft Search vendor "Microsoft" | Windows Search vendor "Microsoft" for product "Windows" | - | - |
Safe
|