Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability is a path traversal issue originating in the sirv library, a dependency of Vite. The core of the issue lies in the viaLocal function within sirv, which fails to properly sanitize user-provided paths. It uses a startsWith check to ensure that the resolved file path is within the designated public directory. However, because it doesn't enforce a trailing slash on the directory path, it's possible to craft a path using ../ that resolves outside the public directory but still passes the startsWith check.
Vite becomes vulnerable by its use of sirv within its servePublicMiddleware. Under specific conditions, namely when a symbolic link exists within the project's public directory, a function in Vite (resolvePublicFiles) returns undefined. This causes the middleware returned by servePublicMiddleware to pass all incoming requests to the vulnerable sirv instance, rather than just requests for files known to be in the public directory. This effectively opens up the path traversal vulnerability in sirv to be exploited through the Vite development server.
The patch for sirv (commit f0113f3f8266328d804ee808f763a3c11f8997eb) addresses the root cause by ensuring the directory path passed to viaLocal always has a trailing slash, making the startsWith check secure against traversal attacks. The patches for Vite consist of updating the sirv dependency to a patched version.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| vite | npm | >= 7.1.0, <= 7.1.4 | 7.1.5 |
| vite | npm | >= 7.0.0, <= 7.0.6 | 7.0.7 |
| vite | npm | >= 6.0.0, <= 6.3.5 | 6.3.6 |
| vite | npm | <= 5.4.19 | 5.4.20 |
