Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem
CVE-2024-23331
What is CVE-2024-23331?
The Vite framework experiences a vulnerability related to its server.fs.deny configuration, particularly on case-insensitive file systems like those found in Windows environments. This flaw allows for a bypass of the intended security measures by utilizing case-augmented filenames. Although the implementation in picomatch is case-sensitive, the file server does not enforce this sensitivity, resulting in a security gap. As a consequence, sensitive files may become accessible despite being protected by the blacklist. To remediate this issue, users are encouraged to upgrade to the provided secure versions of Vite or to restrict access to the development servers as an interim measure.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
vite >=2.7.0, < 2.9.17 < 2.7.0, 2.9.17
vite >=3.0.0, <3.2.8 < 3.0.0, 3.2.8
vite >=4.0.0, < 4.5.2 < 4.0.0, 4.5.2
References
CVSS V3.1
Timeline
Vulnerability published
Vulnerability Reserved