CVE-2023-34092
CVE-2023-34092 · Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Vite provides frontend tooling. Prior to versions 2.9.16, 3.2.7, 4.0.5, 4.1.5, 4.2.3, and 4.3.9, Vite Server Options (`server.fs.deny`) can be bypassed using double forward-slash (//) allows any unauthenticated user to read file from the Vite root-path of the application including the default `fs.deny` settings (`['.env', '.env.*', '*.{crt,pem}']`). Only users explicitly exposing the Vite dev server to the network (using `--host` or `server.host` config option) are affected, and only files in the immediate Vite project root folder could be exposed. This issue is fixed in [email protected], [email protected], [email protected], [email protected], [email protected], and [email protected].
CVSS 7.5 · High · EPSS 3.2% · Public exploit · Fix available
- Published
- Updated
Stack: node
Affected products and versions
vite
- Versions
- < 2.9.16: Affected
- >= 3.0.2, < 3.2.7: Affected
- >= 4.0.0, < 4.0.5: Affected
- >= 4.1.0, < 4.1.5: Affected
- >= 4.2.0, < 4.2.3: Affected
- >= 4.3.0, < 4.3.9: Affected
No fix published
vite npm
- Affected ranges
- SEMVER: < 2.9.16
Update to 2.9.16
vite npm
- Affected ranges
- SEMVER: ≥ 3.0.2, < 3.2.7
Update to 3.2.7
vite npm
- Affected ranges
- SEMVER: ≥ 4.0.0, < 4.0.5
Update to 4.0.5
vite npm
- Affected ranges
- SEMVER: ≥ 4.1.0, < 4.1.5
Update to 4.1.5
vite npm
- Affected ranges
- SEMVER: ≥ 4.2.0, < 4.2.3
Update to 4.2.3
vite npm
- Affected ranges
- SEMVER: ≥ 4.3.0, < 4.3.9
Update to 4.3.9