PT-2024-19813 · Vite · Vite

Dariushoule · Published 2024-01-19 · Updated 2025-01-17 · CVE-2024-23331

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Vite versions prior to 2.9.17 Vite versions prior to 3.2.8 Vite versions prior to 4.5.2 Vite versions prior to 5.0.12

Description The Vite dev server option server.fs.deny can be bypassed on case-insensitive file systems using case-augmented versions of filenames, notably affecting servers hosted on Windows. This bypass is possible because picomatch defaults to case-sensitive glob matching, but the file server does not discriminate. By requesting raw filesystem paths using augmented casing, the matcher derived from config.server.fs.deny fails to block access to sensitive files.

Recommendations For versions prior to 2.9.17, upgrade to version 2.9.17 or later. For versions prior to 3.2.8, upgrade to version 3.2.8 or later. For versions prior to 4.5.2, upgrade to version 4.5.2 or later. For versions prior to 5.0.12, upgrade to version 5.0.12 or later. As a temporary workaround, consider restricting access to dev servers until a patch is available.

Exploit

Fix

Information Disclosure

Improper Access Control

Weakness Enumeration

CWE-178

CWE-200

CWE-284

Related Identifiers

CVE-2024-23331

GHSA-C24V-8RFC-W8VW

OPENSUSE-SU-2025:14663-1

Affected Products

Vite

References · 43

• 🔥 https://github.com/vitejs/vite/security/advisories/GHSA-c24v-8rfc-w8vw · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23331.json · Exploit
• https://github.com/vitejs/vite/commit/91641c4da0a011d4c5352e88fc68389d4e1289a5 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-23331 · Security Note
• https://osv.dev/vulnerability/GHSA-c24v-8rfc-w8vw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-34092 · Security Note
• https://osv.dev/vulnerability/CVE-2024-23331 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:14663-1 · Vendor Advisory
• https://github.com/vitejs/vite · Note
• https://github.com/vitejs/vite/commit/0cd769c279724cf27934b1270fbdd45d68217691 · Note
• https://github.com/vitejs/vite/commit/a26c87d20f9af306b5ce3ff1648be7fa5146c278 · Note
• https://github.com/vitejs/vite/commit/eeec23bbc9d476c54a3a6d36e78455867185a7cb · Note
• https://suse.com/security/cve/CVE-2024-37298 · Note
• https://suse.com/security/cve/CVE-2024-4067 · Note
• https://suse.com/security/cve/CVE-2024-24786 · Note