CVE-2024-45811CWE-200CWE-284

server.fs.deny bypassed when using ?import&raw in vite

Medium · published September 17, 2024

CVSS v3.1
4.8
EPSS
1%
Percentile
65.3
In the wild
Unconfirmed
What it is

Vite a frontend build tooling framework for javascript. In affected versions the contents of arbitrary files can be returned to the browser. `@fs` denies access to files outside of Vite serving allow list. Adding `?import&raw` to the URL bypasses this limitation and returns the file content if it exists. This issue has been patched in versions 5.4.6, 5.3.6, 5.2.14, 4.5.5, and 3.2.11. Users are advised to upgrade. There are no known workarounds for this vulnerability.

The record
Technical detail
CVSS v3.1
4.8 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01096 · 65.3th percentile
Weaknesses
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-284 · Improper Access Control
Published
2024-09-17T20:08Z
EPSS history
Timeline
  • 17 SEP 20:08Z
    server.fs.deny bypassed when using ?import&raw in vite
    cvelistv5