Mitigating PHP2Shell: Everything You Need to Know
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @vitest/mocker | npm | >= 2.1.0, < 4.1.11 | 4.1.11 |
| vitest | npm | >= 2.1.0, < 4.1.11 | 4.1.11 |
| vitest | npm | >= 5.0.0-beta.1, < 5.0.0-rc.2 | 5.0.0-rc.2 |
| @vitest/mocker | npm | >= 5.0.0-beta.1, < 5.0.0-rc.2 | 5.0.0-rc.2 |
Miggo AIRoot Cause AnalysisThe vulnerability exists in the @vitest/mocker package, where redirect mock targets are not validated against Vite's file-serving allowlist. This allows an attacker to register a redirect mock that points to a file outside the intended project root. The root cause is the lack of path validation in two key areas:
Unauthenticated WebSocket: The interceptorPlugin's configureServer function sets up a WebSocket listener (vitest:interceptor:register) that accepts redirect mock registrations. The path provided by the client is combined with the server's root path without any checks to prevent directory traversal. An attacker who can connect to the dev server's WebSocket can exploit this to register a malicious redirect.
Authenticated RPC: A similar flaw exists in the setupBrowserRpc function, which handles mock registration for Vitest's browser mode. Although this path requires authentication, it still fails to validate the redirect path, posing a risk from authenticated users.
The vulnerability is triggered when the mocked module is requested. The interceptorPlugin's load hook then reads the file from the malicious path using readFile, disclosing its contents.
The patches fix this by introducing a check (isFileLoadingAllowed or a new checkFileAccess function) at the point of mock registration to ensure the resolved path is within the server's allowed file system boundaries.
interceptorPlugin.configureServerpackages/mocker/src/node/interceptorPlugin.ts
interceptorPlugin.loadpackages/mocker/src/node/interceptorPlugin.ts
setupBrowserRpcpackages/browser/src/node/rpc.ts