GHSA-8jhw-289h-jh2g
Suggest an improvement- Source
- https://github.com/advisories/GHSA-8jhw-289h-jh2g
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/04/GHSA-8jhw-289h-jh2g/GHSA-8jhw-289h-jh2g.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-8jhw-289h-jh2g
- Aliases
- Published
- 2024-04-03T16:46:17Z
- Modified
- 2024-04-05T01:28:39.527659Z
- Severity
-
- 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
- Summary
- Vite's `server.fs.deny` did not deny requests for patterns with directories.
- Details
-
Summary
Vite dev server option
server.fs.denydid not deny requests for patterns with directories. An example of such a pattern is/foo/**/*.Impact
Only apps setting a custom
server.fs.denythat includes a pattern with directories, and explicitly exposing the Vite dev server to the network (using--hostor <code>server.host</code> config option) are affected.Patches
Fixed in vite@5.2.6, vite@5.1.7, vite@5.0.13, vite@4.5.3, vite@3.2.10, vite@2.9.18
Details
server.fs.denyuses picomatch with the config of{ matchBase: true }. matchBase only matches the basename of the file, not the path due to a bug (https://github.com/micromatch/picomatch/issues/89). The vite config docs read like you should be able to set fs.deny to glob with picomatch. Vite also does not set{ dot: true }and that causes dotfiles not to be denied unless they are explicitly defined.Reproduction
Set fs.deny to
['**/.git/**']and then curl for/.git/config.- with
matchBase: true, you can get any file under.git/(config, HEAD, etc). - with
matchBase: false, you cannot get any file under.git/(config, HEAD, etc).
- with
- Database specific
{ "github_reviewed_at": "2024-04-03T16:46:17Z", "github_reviewed": true, "severity": "MODERATE", "nvd_published_at": "2024-04-04T16:15:09Z", "cwe_ids": [ "CWE-200", "CWE-284" ] }- References
-
- https://github.com/vitejs/vite/security/advisories/GHSA-8jhw-289h-jh2g
- https://nvd.nist.gov/vuln/detail/CVE-2024-31207
- https://github.com/vitejs/vite/commit/011bbca350e447d1b499d242804ce62738c12bc0
- https://github.com/vitejs/vite/commit/5a056dd2fc80dbafed033062fe6aaf4717309f48
- https://github.com/vitejs/vite/commit/89c7c645f09d16a38f146ef4a1528f218e844d67
- https://github.com/vitejs/vite/commit/96a7f3a41ef2f9351c46f3ab12489bb4efa03cc9
- https://github.com/vitejs/vite/commit/ba5269cca81de3f5fbb0f49d58a1c55688043258
- https://github.com/vitejs/vite/commit/d2db33f7d4b96750b35370c70dd2c35ec3b9b649
- https://github.com/vitejs/vite
Affected packages
npm
vite
Package
- Name
- vite
- View open source insights on deps.dev
- Purl
- pkg:npm/vite
vite
Package
- Name
- vite
- View open source insights on deps.dev
- Purl
- pkg:npm/vite
vite
Package
- Name
- vite
- View open source insights on deps.dev
- Purl
- pkg:npm/vite
vite
Package
- Name
- vite
- View open source insights on deps.dev
- Purl
- pkg:npm/vite
vite
Package
- Name
- vite
- View open source insights on deps.dev
- Purl
- pkg:npm/vite
vite
Package
- Name
- vite
- View open source insights on deps.dev
- Purl
- pkg:npm/vite