CVE-2024-23331
📋 TL;DR
This vulnerability allows attackers to bypass Vite's server.fs.deny file access restrictions on case-insensitive file systems (like Windows) by using different letter casing in file paths. This enables unauthorized access to sensitive files that should be blocked. It affects Vite development servers running on Windows or other case-insensitive file systems.
💻 Affected Systems
- Vite
📦 What is this software?
Vite by Vitejs
Vite by Vitejs
Vite by Vitejs
Vite by Vitejs
⚠️ Risk & Real-World Impact
Worst Case
Attackers access sensitive files like .env, configuration files, or source code containing secrets, leading to credential theft, source code exposure, or further system compromise.
Likely Case
Unauthorized file access to development files containing API keys, database credentials, or other sensitive configuration data.
If Mitigated
Limited or no impact if proper network segmentation and access controls are in place for development servers.
🎯 Exploit Status
Exploitation is straightforward by modifying URL casing to bypass deny rules. Similar to CVE-2023-34092.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: vite@5.0.12, vite@4.5.2, vite@3.2.8, vite@2.9.17
Vendor Advisory: https://github.com/vitejs/vite/security/advisories/GHSA-c24v-8rfc-w8vw
Restart Required: Yes
Instructions:
1. Check current Vite version. 2. Update to patched version using npm/yarn/pnpm. 3. Restart development server. 4. Verify fix by testing deny rules with case variations.
🔧 Temporary Workarounds
Restrict Development Server Access
allLimit network access to Vite dev servers to trusted IPs only
Use firewall rules to restrict access
Bind to localhost only: vite --host localhost
Use Case-Sensitive File System
linuxRun Vite on case-sensitive file systems where possible
🧯 If You Can't Patch
- Do not expose Vite development servers to untrusted networks
- Implement additional file access controls at OS/network level
🔍 How to Verify
Check if Vulnerable:
Check if running vulnerable Vite version on case-insensitive file system with server.fs.deny configuredCheck Version:
npm list vite or check package.jsonVerify Fix Applied:
Test that file access is properly denied when using different casing on protected paths📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns with case variations
- Access attempts to denied paths with different casing
Network Indicators:
- HTTP requests to Vite dev server with unusual casing patterns
SIEM Query:
source="vite" AND (path:* OR url:* AND (case OR uppercase OR lowercase))🔗 References
- https://github.com/vitejs/vite/commit/91641c4da0a011d4c5352e88fc68389d4e1289a5
- https://github.com/vitejs/vite/security/advisories/GHSA-c24v-8rfc-w8vw
- https://vitejs.dev/config/server-options.html#server-fs-deny
- https://github.com/vitejs/vite/commit/91641c4da0a011d4c5352e88fc68389d4e1289a5
- https://github.com/vitejs/vite/security/advisories/GHSA-c24v-8rfc-w8vw
- https://vitejs.dev/config/server-options.html#server-fs-deny
