What is GHSA-8jhw-289h-jh2g?

GHSA-8jhw-289h-jh2g is a security advisory published by GitHub Security Advisories with Medium severity. Vite's `server.fs.deny` did not deny requests for patterns with directories.

Which CVE IDs does GHSA-8jhw-289h-jh2g cover?

GHSA-8jhw-289h-jh2g covers the following CVE IDs: CVE-2024-31207. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-8jhw-289h-jh2g?

GHSA-8jhw-289h-jh2g has a CVSS v3 base score of 5.9, published by GitHub Security Advisories.

Which products are affected by GHSA-8jhw-289h-jh2g?

GHSA-8jhw-289h-jh2g affects 6 products, including: npm/vite:\u003e= 2.7.0, \u003c= 2.9.17; npm/vite:\u003e= 3.0.0, \u003c= 3.2.8; npm/vite:\u003e= 4.0.0, \u003c= 4.5.2; npm/vite:\u003e= 5.0.0, \u003c= 5.0.12; npm/vite:\u003e= 5.1.0, \u003c= 5.1.6; and others — see the full list on the advisory page.

GHSA-8jhw-289h-jh2gMediumCVSS 5.9

Vite's `server.fs.deny` did not deny requests for patterns with directories.

Vendor

GitHub Security Advisories

Published

April 3, 2024

Last Modified

April 4, 2024

🔗 CVE IDs covered (1)

CVE-2024-31207 →

📋 Description

Summary

Vite dev server option server.fs.deny did not deny requests for patterns with directories. An example of such a pattern is /foo/**/*.

Impact

Only apps setting a custom server.fs.deny that includes a pattern with directories, and explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.

Patches

Fixed in [email protected], [email protected], [email protected], [email protected], [email protected], [email protected]

Details

server.fs.deny uses picomatch with the config of { matchBase: true }. matchBase only matches the basename of the file, not the path due to a bug (https://github.com/micromatch/picomatch/issues/89). The vite config docs read like you should be able to set fs.deny to glob with picomatch. Vite also does not set { dot: true } and that causes dotfiles not to be denied unless they are explicitly defined.

Reproduction

Set fs.deny to ['**/.git/**'] and then curl for /.git/config.

with matchBase: true, you can get any file under .git/ (config, HEAD, etc).
with matchBase: false, you cannot get any file under .git/ (config, HEAD, etc).

🎯 Affected products6

npm/vite:>= 2.7.0, <= 2.9.17
npm/vite:>= 3.0.0, <= 3.2.8
npm/vite:>= 4.0.0, <= 4.5.2
npm/vite:>= 5.0.0, <= 5.0.12
npm/vite:>= 5.1.0, <= 5.1.6
npm/vite:>= 5.2.0, <= 5.2.5