« Volver al listado

CVE-2025-30208

Estado: AnalizadaAlta (7.5)—

Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. `@fs` denies access to files outside of Vite serving allow list. Adding `?raw??` or `?import&raw??` to the URL bypasses this limitation and returns the file content if it exists. This bypass exists because trailing separators such as `?` are removed in several places, but are not accounted for in query string regexes. The contents of arbitrary files can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network (using `--host` or `server.host` config option) are affected. Versions 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10 fix the issue.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Acceso de red sin autenticación (AV:N, PR:N, UI:N) a servidor Vite expuesto; bypass de validación permite lectura de archivos arbitrarios mediante manipulación de query string (`?raw??`).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Vulnerability ScanningPrivileged Account ManagementNetwork SegmentationLimit Access to Resource Over NetworkFilter Network TrafficApplication Isolation and Sandboxing

Tecnologías afectadas (1)

Vitejs — Vite

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-30208",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-30208",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-03-24T17:40:42.736527Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "REQUIRED",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.6
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "vitejs",
          "product": "vite",
          "versions": [
            {
              "status": "affected",
              "version": "< 4.5.10"
            },
            {
              "status": "affected",
              "version": ">= 5.0.0, < 5.4.15"
            },
            {
              "status": "affected",
              "version": ">= 6.0.0, < 6.0.12"
            },
            {
              "status": "affected",
              "version": ">= 6.1.0, < 6.1.2"
            },
            {
              "status": "affected",
              "version": ">= 6.2.0, < 6.2.3"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-03-24T17:15:21.820",
  "references": [
    {
      "url": "https://github.com/vitejs/vite/commit/315695e9d97cc6cfa7e6d9e0229fb50cdae3d9f4",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/vitejs/vite/commit/80381c38d6f068b12e6e928cd3c616bd1d64803c",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/vitejs/vite/commit/807d7f06d33ab49c48a2a3501da3eea1906c0d41",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/vitejs/vite/commit/92ca12dc79118bf66f2b32ff81ed09e0d0bd07ca",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/vitejs/vite/commit/f234b5744d8b74c95535a7b82cc88ed2144263c1",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/vitejs/vite/security/advisories/GHSA-x574-m823-4x7w",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        },
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. `@fs` denies access to files outside of Vite serving allow list. Adding `?raw??` or `?import&raw??` to the URL bypasses this limitation and returns the file content if it exists. This bypass exists because trailing separators such as `?` are removed in several places, but are not accounted for in query string regexes. The contents of arbitrary files can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network (using `--host` or `server.host` config option) are affected. Versions 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10 fix the issue."
    },
    {
      "lang": "es",
      "value": "Vite, un proveedor de herramientas de desarrollo frontend, presenta una vulnerabilidad en versiones anteriores a 6.2.3, 6.1.2, 6.0.12, 5.4.15 y 4.5.10. `@fs` deniega el acceso a archivos fuera de la lista de permitidos del servidor Vite. Añadir `?raw??` o `?import&amp;raw??` a la URL evita esta limitación y devuelve el contenido del archivo, si existe. Esta omisión se debe a que los separadores finales, como `?`, se eliminan en varios lugares, pero no se tienen en cuenta en las expresiones regulares de las cadenas de consulta. El contenido de archivos arbitrarios puede devolverse al navegador. Solo las aplicaciones que exponen explícitamente el servidor de desarrollo de Vite a la red (mediante la opción de configuración `--host` o `server.host`) se ven afectadas. Las versiones 6.2.3, 6.1.2, 6.0.12, 5.4.15 y 4.5.10 solucionan el problema."
    }
  ],
  "lastModified": "2026-06-17T09:08:21.517",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:vitejs:vite:*:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A925DA49-0EFD-4E21-948C-FE4A45E9A58D",
              "versionEndExcluding": "4.5.10"
            },
            {
              "criteria": "cpe:2.3:a:vitejs:vite:*:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "444AFEE6-1ED5-42A7-AC6D-0D1D829178DB",
              "versionEndExcluding": "5.4.15",
              "versionStartIncluding": "5.0.0"
            },
            {
              "criteria": "cpe:2.3:a:vitejs:vite:*:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ABD9AA82-191F-45F4-BDF5-D3FAC0DD0D66",
              "versionEndExcluding": "6.0.12",
              "versionStartIncluding": "6.0.0"
            },
            {
              "criteria": "cpe:2.3:a:vitejs:vite:*:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "932B0FAC-8C56-43F5-8F2E-322544BD7272",
              "versionEndExcluding": "6.1.2",
              "versionStartIncluding": "6.1.0"
            },
            {
              "criteria": "cpe:2.3:a:vitejs:vite:*:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "578CF5D6-71AF-4A3B-BD07-D4C0A04C443A",
              "versionEndExcluding": "6.2.3",
              "versionStartIncluding": "6.2.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}