GHSA-8gvc-j273-4wm5
Suggest an improvement- Source
- https://github.com/advisories/GHSA-8gvc-j273-4wm5
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-8gvc-j273-4wm5/GHSA-8gvc-j273-4wm5.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-8gvc-j273-4wm5
- Aliases
- Published
- 2025-02-04T16:51:08Z
- Modified
- 2025-02-04T22:03:47Z
- Severity
-
- 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
- Summary
- Vitest browser mode serves arbitrary files
- Details
-
Summary
__screenshot-errorhandler on the browser mode HTTP server that responds any file on the file system. Especially if the server is exposed on the network bybrowser.api.host: true, an attacker can send a request to that handler from remote to get the content of arbitrary files.Details
This
__screenshot-errorhandler on the browser mode HTTP server responds any file on the file system. https://github.com/vitest-dev/vitest/blob/f17918a79969d27a415f70431e08a9445b051e45/packages/browser/src/node/plugin.ts#L88-L130This code was added by https://github.com/vitest-dev/vitest/commit/2d62051f13b4b0939b2f7e94e88006d830dc4d1f.
PoC
- Create a directory and change the current directory to that directory
- Run
npx vitest init browser - Run
npm run test:browser - Run
curl http://localhost:63315/__screenshot-error?file=/path/to/any/file
Impact
Users explicitly exposing the browser mode server to the network by
browser.api.host: truemay get any files exposed. - Database specific
{ "nvd_published_at": "2025-02-04T20:15:50Z", "cwe_ids": [ "CWE-22" ], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2025-02-04T16:51:08Z" }- References
-
- https://github.com/vitest-dev/vitest/security/advisories/GHSA-8gvc-j273-4wm5
- https://nvd.nist.gov/vuln/detail/CVE-2025-24963
- https://github.com/vitest-dev/vitest/commit/2d62051f13b4b0939b2f7e94e88006d830dc4d1f
- https://github.com/vitest-dev/vitest/commit/ed9aeba212df04b83ed01810780663ff2cdd0adf
- https://github.com/vitest-dev/vitest
- https://github.com/vitest-dev/vitest/blob/f17918a79969d27a415f70431e08a9445b051e45/packages/browser/src/node/plugin.ts#L88-L130
- https://vitest.dev/guide/browser/config.html#browser-api
Affected packages
npm / @vitest/browser
Package
- Name
- @vitest/browser
- View open source insights on deps.dev
- Purl
- pkg:npm/%40vitest/browser
npm / @vitest/browser
Package
- Name
- @vitest/browser
- View open source insights on deps.dev
- Purl
- pkg:npm/%40vitest/browser