N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-v2wj-q39q-566r

GHSA-v2wj-q39q-566r: Vite: `server.fs.deny` bypassed with queries

Summary

The contents of files that are specified by server.fs.deny can be returned to the browser.

Impact

Only apps that match the following conditions are affected:

explicitly exposes the Vite dev server to the network (using --host or server.host config option)
the sensitive file exists in the allowed directories specified by server.fs.allow
the sensitive file is denied with a pattern that matches a file by server.fs.deny

Details

On the Vite dev server, files that should be blocked by server.fs.deny (e.g., .env, *.crt) can be retrieved with HTTP 200 responses when query parameters such as ?raw, ?import&raw, or ?import&url&inline are appended.

PoC

Start the dev server: pnpm exec vite root --host 127.0.0.1 --port 5175 --strictPort
Confirm that server.fs.deny is enforced (expect 403): curl -i http://127.0.0.1:5175/src/.env | head -n 20 <img width="3944" height="1092" alt="image" src="https://github.com/user-attachments/assets/ecb9f2e0-e08f-4ac7-b194-e0f988c4cd4f" />
Confirm that the same files can be retrieved with query parameters (expect 200): <img width="2014" height="373" alt="image" src="https://github.com/user-attachments/assets/76bc2a6a-44f4-4161-ae47-eab5ae0c04a8" />

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-v2wj-q39q-566r

GHSA-v2wj-q39q-566r:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
vite	npm	>= 8.0.0, <= 8.0.4	8.0.5
vite	npm	>= 7.1.0, <= 7.3.1	7.3.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability in Vite (GHSA-v2wj-q39q-566r) allows an attacker to bypass file access restrictions defined in server.fs.deny by appending query parameters like ?raw or ?import to the requested URL. The root cause of this issue lies in the access control logic which incorrectly performed checks against the full URL, including the query string, instead of just the file path.

The provided patch addresses this vulnerability by modifying the isServerAccessDeniedForTransform and transformMiddleware functions in packages/vite/src/node/server/middlewares/transform.ts. The fix involves using the cleanUrl() utility to strip any query parameters from the request URL before performing the access check with checkLoadingAccess(). This ensures that the server.fs.deny rules are correctly applied to the file path, regardless of any appended queries.

Therefore, during an exploit attempt, the transformMiddleware would be the primary function in the stack trace, as it's the entry point for the vulnerable logic. The isServerAccessDeniedForTransform function is a key helper function that contains the flawed access check, making it a critical indicator of the vulnerability being triggered.

Vulnerable functions

isServerAccessDeniedForTransform

packages/vite/src/node/server/middlewares/transform.ts

This function was vulnerable because it only checked for access control on the full request URL, including query parameters. An attacker could append a query string to a denied file path, and this check would fail to match the deny rule. The patch fixes this by also checking the URL after stripping the query parameters with `cleanUrl()`.

transformMiddleware

packages/vite/src/node/server/middlewares/transform.ts

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.