CVE-2024-31207

Executive Summary

CVE-2024-31207 is a path traversal vulnerability in Vite, a popular frontend build tool. The vulnerability resides in the server.fs.deny configuration option, which is intended to restrict file system access. Due to improper handling of directory patterns, an attacker can bypass these restrictions and access sensitive files outside the allowed scope. The vulnerability has a CVSS score of 5.9 (Medium), with a low EPSS score of 0.0%, indicating a low probability of active exploitation in the wild. However, given Vite's widespread use in modern web development, the potential impact on development and production environments is significant.

Supply Chain & Package Security

Vite is distributed as an npm package. This vulnerability affects the core Vite server component, which is often used in development environments and, in some cases, production. The supply chain risk is moderate, as the vulnerability is in the server itself, not a dependency. However, any application using a vulnerable version of Vite is at risk. Organizations should audit their package.json and package-lock.json files to ensure they are not using an affected version. The npm ecosystem's reliance on semantic versioning means that automatic updates may not have been applied, leaving many installations vulnerable.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low (L) - No special conditions are required for exploitation.
• Privileges Required (PR): None (N) - No authentication is needed.
• User Interaction (UI): None (N) - The victim does not need to perform any action.
• Scope (S): Unchanged (U) - The vulnerable component and the impacted component are the same.
• Confidentiality (C): Low (L) - Limited information disclosure is possible.
• Integrity (I): None (N) - No data modification is possible.
• Availability (A): None (N) - No denial of service is possible.

Threat Level: Medium. The vulnerability allows for limited file disclosure but does not enable code execution or data modification. The low EPSS score suggests that exploitation is not currently widespread, but the ease of exploitation and the popularity of Vite make it a potential target for automated scanning.

Deep Dive & Mechanics

The server.fs.deny option in Vite is designed to prevent access to sensitive files and directories (e.g., .env, node_modules). It uses a list of glob patterns to match against requested file paths. The vulnerability arises because the pattern matching logic does not correctly handle directory separators. Specifically, when a pattern like **/.env is used, it should match any .env file in any directory. However, due to a flaw in the path normalization or matching algorithm, an attacker can bypass this by using URL-encoded characters or path traversal sequences.

For example, a request to /.env might be blocked, but a request to /public/../.env or /%2e%2e/.env could bypass the filter. The root cause is that the deny list is applied after URL decoding but before path normalization, or vice versa, leading to inconsistencies. The patched versions correct this by ensuring that the deny list is applied to the fully normalized and decoded path.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable: Deny list applied before path normalization
const denied = server.fs.deny.some(pattern => {
  return minimatch(requestPath, pattern);
});
if (denied) {
  return 403;
}
// Path normalization happens later
const normalizedPath = path.normalize(requestPath);

Patched Code (Conceptual):

// Patched: Path normalization and decoding before deny check
const decodedPath = decodeURIComponent(requestPath);
const normalizedPath = path.normalize(decodedPath);
const denied = server.fs.deny.some(pattern => {
  return minimatch(normalizedPath, pattern);
});
if (denied) {
  return 403;
}

The key difference is the order of operations. In the vulnerable version, the deny check is performed on the raw request path, which may contain traversal sequences or encoded characters. The patched version first decodes and normalizes the path, ensuring that the deny list is applied to the actual file path that will be accessed.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A Vite development server running a vulnerable version (e.g., 5.2.5).
• The server must have server.fs.deny configured (default configuration is vulnerable).

Exploitation Steps:

1. Identify a vulnerable Vite server. Look for the Vite default page or any endpoint that returns Vite-related headers.
2. Attempt to access a denied file directly. For example, http://target:5173/.env should return a 403 error.
3. Bypass the deny list using path traversal. Try the following payloads:
   • http://target:5173/public/../.env
   • http://target:5173/%2e%2e/.env
   • http://target:5173/..%252f..%252f.env (double encoding)
4. If successful, the contents of the .env file will be returned.

Example cURL command:

curl -v --path-as-is "http://target:5173/public/../.env"

Expected Output:

HTTP/1.1 200 OK
...
DATABASE_URL=postgres://user:pass@localhost/db
SECRET_KEY=supersecret

Blue Team (Detection & Prevention)

Detection:

• Monitor web server logs for requests containing ../, %2e%2e, or other path traversal sequences.
• Look for requests to sensitive files like .env, config.json, or node_modules that return a 200 status code instead of 403.
• Use the detection rules provided in the next section.

Prevention:

• Immediately upgrade Vite to a patched version (5.2.6, 5.1.7, 5.0.13, 4.5.3, 3.2.10, or 2.9.18).
• If upgrading is not possible, implement a reverse proxy (e.g., Nginx) with strict path validation rules.
• Disable the Vite development server in production environments.
• Use a Web Application Firewall (WAF) with rules to block path traversal attempts.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests with ../ or %2e%2e in the path.
  • Requests to files like .env, config.json, credentials.json, or package.json from unexpected sources.
  • 403 errors followed by 200 successes for the same file path.

• File System IOCs:

  • Unauthorized access to files outside the Vite project root.
  • Modified or exfiltrated .env or configuration files.

• Log IOCs:

  • Web server logs showing successful requests to paths containing ../.
  • Vite server logs showing [vite] http proxy or [vite] serving for suspicious paths.

Detection Engineering

YARA Rule

rule CVE_2024_31207_Vite_Path_Traversal {
    meta:
        description = "Detects path traversal attempts targeting Vite server.fs.deny bypass"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-31207"
        severity = "medium"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $traversal3 = "%2e%2e/"
        $traversal4 = "%2e%2e\\"
        $traversal5 = "..%252f"
        $sensitive1 = ".env"
        $sensitive2 = "config.json"
        $sensitive3 = "credentials.json"
        $sensitive4 = "package.json"
        $sensitive5 = "node_modules"
    condition:
        any of ($traversal*) and any of ($sensitive*)
}

Sigma Rule

title: CVE-2024-31207 Vite Path Traversal Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests attempting to exploit CVE-2024-31207 in Vite
author: Valters IT
date: 2024-10-27
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-31207
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - '../'
            - '..\\'
            - '%2e%2e'
            - '..%252f'
        cs-uri-query|endswith:
            - '.env'
            - 'config.json'
            - 'credentials.json'
            - 'package.json'
    condition: selection
falsepositives:
    - Legitimate use of path traversal in application logic (rare)
level: medium
tags:
    - attack.initial_access
    - attack.t1190

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-31207 Vite Path Traversal Attempt"; flow:to_server,established; content:"GET"; http_method; content:"../"; http_uri; content:".env"; http_uri; distance:0; within:100; sid:1000001; rev:1; reference:cve,2024-31207;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Vite: Update to the latest patched version for your major release line:
   • Vite 5.x: Upgrade to 5.2.6 or later.
   • Vite 4.x: Upgrade to 4.5.3 or later.
   • Vite 3.x: Upgrade to 3.2.10 or later.
   • Vite 2.x: Upgrade to 2.9.18 or later.
2. Verify the upgrade: Check the Vite version by running npx vite --version or inspecting the package.json file.

Long-term Mitigations:

• Network Segmentation: Ensure Vite development servers are not exposed to the public internet. Use a VPN or localhost-only binding.
• Reverse Proxy: Place a reverse proxy (e.g., Nginx, Apache) in front of Vite to add an additional layer of path validation.
• WAF Rules: Deploy WAF rules to block path traversal patterns.
• Monitoring: Implement continuous monitoring for path traversal attempts using the detection rules provided above.

Workaround (if upgrade is not possible):

• Manually patch the server.fs.deny logic by adding additional deny rules for encoded and traversed paths. However, this is not recommended as it may not cover all bypass vectors.

Valters IT
Securing Digital Frontiers