Viteの開発サーバーにRCE脆弱性、修正版を公開

Summary

By sending an HTTP request to the dev server, a arbitrary code execution was possible.

Impact

Only apps that match the following condition are affected:

• explicitly exposes the Vite dev server to the network (using --host or server.host config option)

Details

Vite's resolver plugin has __vite-browser-external: virtual module and __vite-optional-peer-dep: virtual module. These modules embedded the module ID, which is derived from the URL, without escaping. The `` can be any value, so any code was able to be injected in those modules.

Since Vite trusts the module code, there was two problems with this injection.

First, the modules referenced by a module are allowed for the server.fs check. For example, if the attacker injects import '/path/to/some-secret-file.txt', /path/to/some-secret-file.txt can be fetched.

Second, Vite uses eval to extract the value in the module code for new Worker and import.meta.glob. By using that functionality, the attacker can make Vite evaluate the injected code on the server. Vite prevents some module / global variables like exports, require to avoid bugs, but because this is not a security boundary, there's a bypass like globalThis.process.getBuiltinModule.

PoC

printf 'CANARY-SECRET-not-valid-js\n' > /tmp/decoy-secret.txt   # outside the project
vite

/tmp/decoy-secret.txt stands in for any sensitive file outside the…