CVE-2025-30208 PoC — Vite bypasses server.fs.deny when using `?raw??`

Description

CVE-2025-30208 ViteVulnScanner

Readme

# CVE-2025-30208-ViteVulnScanner

Yo, this is a dope multi-threaded Python script by [keklick1337](https://github.com/keklick1337) to hunt down domains vulnerable to CVE-2025-30208 in Vite. Basically, it checks if you can snag random files via the `@fs` endpoint with `?raw??` or `?import&raw??` — think `/etc/passwd` leaks and other juicy shit. It’s got some smart false-positive filtering so you don’t waste time on crap, plus options to tweak how it spits out the results.

## What’s It Got?
- **Multi-threading**: Hammers through domain lists fast as fuck.
- **Protocol Flex**: Pick HTTP, HTTPS, or let it rip on both.
- **False-Positive Killer**: 
  - Checks a bullshit path to see if the server’s just trolling with 200 OK and HTML.
  - Ditches responses with `<head>` and `<body>` unless it smells legit.
- **Vuln Vibes**: Spots `sourcemappingurl` or `export default` to confirm the good stuff.
- **Output Choices**: 
  - Text files (`results_good.txt`, `results_maybe_good.txt`, `results_bad.txt`).
  - JSONL for the nerds who love details.
  - Toss in URLs with `-u` if you’re into that.
- **Console Spam**: Logs everything so you know what’s up.

## What You Need
- Python 3.6+ (older shit won’t cut it).
- Stuff to install:
  - `requests`
  - `urllib3`

## How to Get It Running
1. Grab it from GitHub:
   ```bash
   git clone https://github.com/keklick1337/CVE-2025-30208-ViteVulnScanner.git
   cd CVE-2025-30208-ViteVulnScanner
   ```
2. Install the dependencies (if you ain’t got ‘em already):
   ```bash
   pip install requests urllib3
   ```
3. Set up your files:
   - `path_list.txt`: Paths to check, one per line (e.g., `/etc/passwd`).
   - `domains.txt`: Domains to hit, one per line (e.g., `example.com`).

## How to Use It
Fire it up like this:

```bash
python3 CVE-2025-30208.py <domains_file> [options]
```

### Options, Bro
- `<domains_file>`: Your domains list (no file, no scan, duh).
- `-t, --threads`: How many threads to unleash (default: 10).
- `-p, --protocol`: Force `http` or `https`, or skip it for both.
- `-u, --urls`: Slap vulnerable URLs into the output.
- `-o, --output`: Base name for files (default: `results`).
- `-f, --format`: `txt` for split files or `jsonl` for one big-ass file (default: `txt`).

### Examples
1. Basic run, chill settings:
   ```bash
   python3 CVE-2025-30208.py domains.txt
   ```
2. Go hard with 20 threads, URLs, and JSONL:
   ```bash
   python3 CVE-2025-30208.py domains.txt -t 20 -u -f jsonl
   ```
3. 5 threads, HTTPS only, text vibes:
   ```bash
   python3 CVE-2025-30208.py domains.txt -t 5 -p https
   ```

## What You Get
### Text Mode (`-f txt`)
- `results_good.txt`: Shit that’s definitely fucked (has `sourcemappingurl` or `export default`).
- `results_maybe_good.txt`: Could be vuln, but no smoking gun.
- `results_bad.txt`: Clean, no worries.
- Add `-u` and URLs get tacked on with a tab (`\t`).

#### Sample `results_good.txt` with `-u`:
```
example.com    https://example.com/@fs/etc/passwd?raw??
```

### JSONL Mode (`-f jsonl`)
- Files: `results_good.jsonl`, `results_maybe_good.jsonl`, `results_bad.jsonl`.
- Each line’s a JSON with:
  - `domain`: What you scanned.
  - `status`: `VULNERABLE`, `MAYBE VULNERABLE`, or `BAD`.
  - `url` (if `-u`): Where it’s fucked.
  - `response`: What the server coughed up.

#### Sample `results_good.jsonl`:
```json
{"domain": "example.com", "status": "VULNERABLE", "url": "https://example.com/@fs/etc/passwd?raw??", "response": "root:x:0:0:root:/root:/bin/bash"}
```

## How It Rolls
1. **False-Positive Check**: 
   - Hits a fake path (`/1e4c911a3fd2244596863ddbfa6f3600/7970621079b41658dcd6c205640b3602/fake`).
   - If it’s 200 OK with `<head>` and `<body>`, it’s a nope — server’s just being a dick.
2. **Vuln Hunt**:
   - Tries every path in `path_list.txt` with `@fs/<path>?raw??` and `?import&raw??`.
   - 200 OK? 
     - HTML with `<head>` and `<body>`? Skip that shit.
     - `sourcemappingurl` or `export default`? Boom, `GOOD`.
     - Just 200? `MAYBE_GOOD`.
   - No 200? `BAD`.
3. **Output**: Dumps it all where you told it to.

## Heads-Up
- SSL warnings are off (`urllib3.disable_warnings()`), so it doesn’t bitch about certs. Careful out there.
- Tweak `path_list.txt` for your targets — sensitive files are the real deal.
- False-positive filter assumes HTML means safe. If that’s bullshit for your setup, change it.

## Disclaimer
Listen up: this shit’s for educational purposes only, fam. I ain’t responsible if you fuck something up, get caught, or piss someone off with this. Use it to learn, not to be a dickhead. All risks are on you, nahuy — I’m just here dropping code.

## Who’s Behind It
- GitHub: [keklick1337](https://github.com/keklick1337) — that’s me, yo.

## Wanna Help?
Got ideas? Found a bug? Hit me up with issues or pull requests. More ways to kill false positives or dope features? Let’s make this beast even sicker.

File Snapshot

Remarks