| Package | Affected versions | Patched versions |
|---|---|---|
| vite | ≥ 2.7.0, < 2.9.18≥ 3.0.0, < 3.2.10≥ 4.0.0, < 4.5.3≥ 5.0.0, < 5.0.13≥ 5.1.0, < 5.1.7≥ 5.2.0, < 5.2.6 | 2.9.183.2.104.5.35.0.135.1.75.2.6 |
Vite dev server option server.fs.deny did not deny requests for patterns with directories. An example of such a pattern is /foo/**/*.
Only apps setting a custom server.fs.deny that includes a pattern with directories, and explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.
Fixed in [email protected], [email protected], [email protected], [email protected], [email protected], [email protected]
server.fs.deny uses picomatch with the config of { matchBase: true }. matchBase only matches the basename of the file, not the path due to a bug (https://github.com/micromatch/picomatch/issues/89). The vite config docs read like you should be able to set fs.deny to glob with picomatch. Vite also does not set { dot: true } and that causes dotfiles not to be denied unless they are explicitly defined.
Reproduction
Set fs.deny to ['**/.git/**'] and then curl for /.git/config.
matchBase: true, you can get any file under .git/ (config, HEAD, etc).matchBase: false, you cannot get any file under .git/ (config, HEAD, etc).Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free