Описание
Vite is a frontend tooling framework for javascript. The contents of arbitrary files can be returned to the browser. By adding ?.svg with ?.wasm?init or with sec-fetch-dest: script header, the server.fs.deny restriction was able to bypass. This bypass is only possible if the file is smaller than build.assetsInlineLimit (default: 4kB) and when using Vite 6.0+. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 4.5.12, 5.4.17, 6.0.14, 6.1.4, and 6.2.5.
A flaw was discovered in the Vite frontend framework for JavaScript. In affected versions, it is possible for arbitrary files to be returned to the browser via a specially-crafter header. Only apps explicitly exposing the Vite dev server to the network using --host or server.host config option are affected.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Ansible Automation Platform 2 | automation-controller | Fix deferred | ||
| Red Hat Ansible Automation Platform 2 | automation-eda-controller | Fix deferred | ||
| Red Hat Ansible Automation Platform 2 | automation-gateway | Fix deferred | ||
| Red Hat JBoss Enterprise Application Platform 8 | org.keycloak-keycloak-parent | Fix deferred | ||
| Red Hat JBoss Enterprise Application Platform Expansion Pack | org.keycloak-keycloak-parent | Fix deferred | ||
| Red Hat OpenShift distributed tracing 3 | rhosdt/tempo-gateway-opa-rhel8 | Fix deferred | ||
| Red Hat OpenShift distributed tracing 3 | rhosdt/tempo-gateway-rhel8 | Fix deferred | ||
| Red Hat OpenShift distributed tracing 3 | rhosdt/tempo-jaeger-query-rhel8 | Fix deferred | ||
| Red Hat OpenShift distributed tracing 3 | rhosdt/tempo-query-rhel8 | Fix deferred | ||
| Red Hat OpenShift distributed tracing 3 | rhosdt/tempo-rhel8 | Fix deferred |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
5.3 Medium
CVSS3
Связанные уязвимости
Vite is a frontend tooling framework for javascript. The contents of arbitrary files can be returned to the browser. By adding ?.svg with ?.wasm?init or with sec-fetch-dest: script header, the server.fs.deny restriction was able to bypass. This bypass is only possible if the file is smaller than build.assetsInlineLimit (default: 4kB) and when using Vite 6.0+. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 4.5.12, 5.4.17, 6.0.14, 6.1.4, and 6.2.5.
Vite is a frontend tooling framework for javascript. The contents of a ...
Vite allows server.fs.deny to be bypassed with .svg or relative paths
EPSS
5.3 Medium
CVSS3