GHSA-8jhw-289h-jh2g

Dashboard / Vulnerabilities / GHSA-8jhw-289h-jh2g

GHSA-8jhw-289h-jh2g

Summary: Vite's `server.fs.deny` did not deny requests for patterns with directories.

Details: ### Summary [Vite dev server option](https://vitejs.dev/config/server-options.html#server-fs-deny) `server.fs.deny` did not deny requests for patterns with directories. An example of such a pattern is `/foo/**/*`. ### Impact Only apps setting a custom `server.fs.deny` that includes a pattern with directories, and explicitly exposing the Vite dev server to the network (using `--host` or [`server.host` config option](https://vitejs.dev/config/server-options.html#server-host)) are affected. ### Patches Fixed in [email protected], [email protected], [email protected], [email protected], [email protected], [email protected] ### Details `server.fs.deny` uses picomatch with the config of `{ matchBase: true }`. [matchBase](https://github.com/micromatch/picomatch/blob/master/README.md#options:~:text=Description-,basename,-boolean) only matches the basename of the file, not the path due to a bug (https://github.com/micromatch/picomatch/issues/89). The vite config docs read like you should be able to set fs.deny to glob with picomatch. Vite also does not set `{ dot: true }` and that causes [dotfiles not to be denied](https://github.com/micromatch/picomatch/blob/master/README.md#options:~:text=error%20is%20thrown.-,dot,-boolean) unless they are explicitly defined. **Reproduction** Set fs.deny to `['**/.git/**']` and then curl for `/.git/config`. * with `matchBase: true`, you can get any file under `.git/` (config, HEAD, etc). * with `matchBase: false`, you cannot get any file under `.git/` (config, HEAD, etc).

References: https://github.com/vitejs/vite/security/advisories/GHSA-8jhw-289h-jh2g, https://nvd.nist.gov/vuln/detail/CVE-2024-31207, https://github.com/vitejs/vite/commit/011bbca350e447d1b499d242804ce62738c12bc0, https://github.com/vitejs/vite/commit/5a056dd2fc80dbafed033062fe6aaf4717309f48, https://github.com/vitejs/vite/commit/89c7c645f09d16a38f146ef4a1528f218e844d67, https://github.com/vitejs/vite/commit/96a7f3a41ef2f9351c46f3ab12489bb4efa03cc9, https://github.com/vitejs/vite/commit/ba5269cca81de3f5fbb0f49d58a1c55688043258, https://github.com/vitejs/vite/commit/d2db33f7d4b96750b35370c70dd2c35ec3b9b649, https://github.com/vitejs/vite