Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

chore(deps): update dependency vite to v3.2.10 [security] #32

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

chore(deps): update dependency vite to v3.2.10 [security] #32

wants to merge 1 commit into from

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Jun 13, 2023 •
edited

Mend Renovate

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
vite (source) 3.0.3 -> 3.2.10 age adoption passing confidence

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

GitHub Vulnerability Alerts

CVE-2023-34092

Summary

The issue involves a security vulnerability in Vite, where the server options can be bypassed using a double forward slash (//). This vulnerability poses a potential security risk as it can allow unauthorized access to sensitive directories and files. This document outlines the steps to address and mitigate this issue. Adding Extra References : ## Steps to Fix. Update Vite:Ensure that you are using the latest version of Vite. Security issues like this are often fixed in newer releases.\n\n2. Secure the Server Configuration:In your vite.config.js file, review and update the server configuration options to restrict access to unauthorized requests or directories. For example:```javascript\n // vite.config.js\n export default { server: {\n fs: {\n deny: ['private-directory'] // Restrict access to specific directories

Impact

Only users explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected, and only files in the immediate Vite project root folder could be exposed.

Patches

Fixed in vite@4.3.9, vite@4.2.3, vite@4.1.5, vite@4.0.5
And in the latest minors of the previous two majors: vite@3.2.7, vite@2.9.16

Details

Vite serve the application with under the root-path of the project while running on the dev mode. By default, vite using server options fs.deny to protected the sensitive information of the file. But, with simply double forward-slash, we can bypass this fs restriction.

PoC

  1. Create a new latest project of vite using any package manager. (here I'm using react and vue templates for tested and pnpm)
  2. Serve the application on dev mode using pnpm run dev.
  3. Directly access the file from url using double forward-slash (//) (e.g: //.env, //.env.local)
  4. Server Options fs.deny restrict successfully bypassed.

Proof Images:
proof-1
proof-2

CVE-2024-23331

Summary

Vite dev server option server.fs.deny can be bypassed on case-insensitive file systems using case-augmented versions of filenames. Notably this affects servers hosted on Windows.

This bypass is similar to https://nvd.nist.gov/vuln/detail/CVE-2023-34092 -- with surface area reduced to hosts having case-insensitive filesystems.

Patches

Fixed in vite@5.0.12, vite@4.5.2, vite@3.2.8, vite@2.9.17

Details

Since picomatch defaults to case-sensitive glob matching, but the file server doesn't discriminate; a blacklist bypass is possible.

See picomatch usage, where nocase is defaulted to false: https://github.com/vitejs/vite/blob/v5.1.0-beta.1/packages/vite/src/node/server/index.ts#L632

By requesting raw filesystem paths using augmented casing, the matcher derived from config.server.fs.deny fails to block access to sensitive files.

PoC

Setup

  1. Created vanilla Vite project using npm create vite@latest on a Standard Azure hosted Windows 10 instance.
  2. Created dummy secret files, e.g. custom.secret and production.pem
  3. Populated vite.config.js with
export default { server: { fs: { deny: ['.env', '.env.*', '*.{crt,pem}', 'custom.secret'] } } }

Reproduction

  1. curl -s http://20.12.242.81:5173/@​fs//
    • Descriptive error page reveals absolute filesystem path to project root
  2. curl -s http://20.12.242.81:5173/@​fs/C:/Users/darbonzo/Desktop/vite-project/vite.config.js
    • Discoverable configuration file reveals locations of secrets
  3. curl -s http://20.12.242.81:5173/@​fs/C:/Users/darbonzo/Desktop/vite-project/custom.sEcReT
    • Secrets are directly accessible using case-augmented version of filename

Proof
Screenshot 2024-01-19 022736

Impact

Who

  • Users with exposed dev servers on environments with case-insensitive filesystems

What

  • Files protected by server.fs.deny are both discoverable, and accessible

CVE-2024-31207

Summary

Vite dev server option server.fs.deny did not deny requests for patterns with directories. An example of such a pattern is /foo/**/*.

Impact

Only apps setting a custom server.fs.deny that includes a pattern with directories, and explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.

Patches

Fixed in vite@5.2.6, vite@5.1.7, vite@5.0.13, vite@4.5.3, vite@3.2.10, vite@2.9.18

Details

server.fs.deny uses picomatch with the config of { matchBase: true }. matchBase only matches the basename of the file, not the path due to a bug (https://github.com/micromatch/picomatch/issues/89). The vite config docs read like you should be able to set fs.deny to glob with picomatch. Vite also does not set { dot: true } and that causes dotfiles not to be denied unless they are explicitly defined.

Reproduction

Set fs.deny to ['**/.git/**'] and then curl for /.git/config.

  • with matchBase: true, you can get any file under .git/ (config, HEAD, etc).
  • with matchBase: false, you cannot get any file under .git/ (config, HEAD, etc).

Release Notes

vitejs/vite (vite)

v3.2.10

Compare Source

Please refer to CHANGELOG.md for details.

v3.2.8

Compare Source

Please refer to CHANGELOG.md for details.

v3.2.7

Compare Source

Please refer to CHANGELOG.md for details.

v3.2.6

Compare Source

v3.2.5

Compare Source

v3.2.4

Compare Source

v3.2.3

Compare Source

v3.2.2

Compare Source

v3.2.1

Compare Source

v3.2.0

Compare Source

Main Changes
Multiple Entries for Library Mode

Library mode now supports multiple entries:

  lib: {
    entry: {
        primary: 'src/index.ts',
        secondary: 'src/secondary.ts'
    },
    formats: ['es', 'cjs']
  }
  // => primary.es.js, primary.cjs.js, secondary.es.js, secondary.cjs.js

Check out the PR #​7047, and the build.lib config docs

build.modulePreload options

Vite now allows filtering and modifying module preload dependencies for each entry and async chunk. experimental.renderBuiltUrl will also get called for preload asset paths. And build.modulePreload.resolveDependencies will be called both for JS dynamic imports preload lists and also for HTML preload lists for chunks imported from entry HTML files. Refer to the PR for more context #​9938 and check out the modulePreload config docs. Note: build.modulePreloadPolyfill is now deprecated, please migrate to build.modulePreload.polyfill.

Include Duplicate Assets in the Manifest

Laravel and other backends integrations will now get entries for every asset file, even if they have been de-duplicated. See #​9928 for more information.

Customizable ErrorOverlay

You can now customize the ErrorOverlay by using css parts. Check out the PR for more details: #​10234.

Features
Bug Fixes
Previous Changelogs
3.2.0-beta.4 (2022-10-24)

See 3.2.0-beta.4 changelog

3.2.0-beta.3 (2022-10-20)

See 3.2.0-beta.3 changelog

3.2.0-beta.2 (2022-10-14)

See 3.2.0-beta.2 changelog

3.2.0-beta.1 (2022-10-10)

See 3.2.0-beta.1 changelog

3.2.0-beta.0 (2022-10-05)

See 3.2.0-beta.0 changelog

v3.1.8

Compare Source

Please refer to CHANGELOG.md for details.

v3.1.7

Compare Source

Please refer to CHANGELOG.md for details.

v3.1.6

Compare Source

Please refer to CHANGELOG.md for details.

v3.1.5

Compare Source

Please refer to CHANGELOG.md for details.

v3.1.4

Compare Source

Please refer to CHANGELOG.md for details.

v3.1.3

Compare Source

v3.1.2

Compare Source

v3.1.1

Compare Source

v3.1.0

Compare Source

Main Changes
  • Vite now uses parse5, which parses HTML in the same way as the latest browser versions. This migration gives us a more robust HTML story moving forward (#​9678).
  • Vite now supports using objects as hooks to change execution order (#​9634). Check out the RFC and the implementation upstream at rollup/rollup#4600 for details and rationale. 
      import { resolve } from 'node:path';
  import { readdir } from 'node:fs/promises';

  export default function getFilesOnDisk() {
    return {
      name: 'getFilesOnDisk',
      writeBundle: {
        // run this hook sequentially even if the hook is parallel
        sequential: true,
        // push this hook to the 'post' stage, after all normal hooks
        order: 'post',
        // hook implementation
        async handler({ dir }) {
          const topLevelFiles = await readdir(resolve(dir))
          console.log(topLevelFiles)
        }
      }
    }
  }
    Read the updated Rollup Plugin docs for more information.

Note
After Vite 3.1, you are no longer going to see [vite] hot updated log messages in the browser console. These messages have been moved to the debug channel (#​8855). Check your browser docs to show debug logs.

Features
Bug Fixes
Previous Changelogs
3.1.0-beta.2 (2022-09-02)

See 3.1.0-beta.2 changelog

3.1.0-beta.1 (2022-08-29)

See 3.1.0-beta.1 changelog

3.1.0-beta.0 (2022-08-25)

See 3.1.0-beta.0 changelog

v3.0.9

Compare Source

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.

@renovate renovate bot added dependencies Pull requests that update a dependency file ready for review labels Jun 13, 2023
@renovate renovate bot requested a review from effervescentia June 13, 2023 14:25
@renovate renovate bot force-pushed the renovate/npm-vite-vulnerability/VF-000 branch from 992a7cd to 9bdfa4a Compare December 12, 2023 14:52
@renovate renovate bot force-pushed the renovate/npm-vite-vulnerability/VF-000 branch from 9bdfa4a to b3d0d17 Compare January 19, 2024 22:47
@renovate renovate bot changed the title chore(deps): update dependency vite to v3.2.7 [security] chore(deps): update dependency vite to v3.2.8 [security] Jan 19, 2024
@renovate renovate bot force-pushed the renovate/npm-vite-vulnerability/VF-000 branch from b3d0d17 to b4fc100 Compare April 3, 2024 18:13
@renovate renovate bot changed the title chore(deps): update dependency vite to v3.2.8 [security] chore(deps): update dependency vite to v3.2.10 [security] Apr 3, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@effervescentia effervescentia Awaiting requested review from effervescentia

At least 1 approving review is required to merge this pull request.

Assignees
No one assigned
Labels
dependencies Pull requests that update a dependency file ready for review
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
0 participants