Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem

CVE-2024-23331

Summary

The Vite framework experiences a vulnerability related to its server.fs.deny configuration, particularly on case-insensitive file systems like those found in Windows environments. This flaw allows for a bypass of the intended security measures by utilizing case-augmented filenames. Although the implementation in picomatch is case-sensitive, the file server does not enforce this sensitivity, resulting in a security gap. As a consequence, sensitive files may become accessible despite being protected by the blacklist. To remediate this issue, users are encouraged to upgrade to the provided secure versions of Vite or to restrict access to the development servers as an interim measure.

References