Cyber Resilience

CVE-2023-34092

Info Disclosure in Vitejs Vite 3.0.2 – 3.2.7

Public PoCInfo Disclosure
Published
01 June 2023
Modified
21 November 2024
Patch / advisory
CVSS Score v3.1 7.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.032 87th percentile
Risk Priority 79 floored blend · peak EPSS

Summary

CVE-2023-34092 is a high-severity Path Equivalence: '//multiple/leading/slash' (CWE-50) vulnerability in Vitejs Vite. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception (T1034); ranked in the top 13% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

Vite is a frontend build tooling package whose development server is affected by a path traversal issue in all releases prior to 2.9.16, 3.2.7, 4.0.5, 4.1.5, 4.2.3, and 4.3.9. The server.fs.deny mechanism, which blocks access to files matching patterns such as .env, .env.*, and *.crt or *.pem, can be circumvented by inserting a double forward slash in request paths, exposing any file located directly in the project root.

Only instances that have been deliberately made reachable over the network (via the --host command-line flag or the server.host configuration option) are impacted. An unauthenticated remote attacker who can reach such a server can retrieve the contents of any file in the immediate project root, including secrets that the deny list was intended to protect, resulting in high confidentiality impact with no authentication or user interaction required.

The official advisory GHSA-353f-5xf4-qw67 and the associated pull request and commits document the root-cause fix and list the six patched versions that close the bypass. The EPSS score has remained flat at its current peak of 0.5673 with no material upward movement after disclosure.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

Vite provides frontend tooling. Prior to versions 2.9.16, 3.2.7, 4.0.5, 4.1.5, 4.2.3, and 4.3.9, Vite Server Options (`server.fs.deny`) can be bypassed using double forward-slash (//) allows any unauthenticated user to read file from the Vite root-path of the application including…

more

the default `fs.deny` settings (`['.env', '.env.*', '*.{crt,pem}']`). Only users explicitly exposing the Vite dev server to the network (using `--host` or `server.host` config option) are affected, and only files in the immediate Vite project root folder could be exposed. This issue is fixed in vite@4.3.9, vite@4.2.3, vite@4.1.5, vite@4.0.5, vite@3.2.7, and vite@2.9.16.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise Techniques

T1034 Path Interception Persistence
**This technique has been deprecated.
T1134.001 Token Impersonation/Theft Stealth
Adversaries may duplicate then impersonate another user's existing token to escalate privileges and bypass access controls.
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1552 Unsecured Credentials Credential Access
Adversaries may search compromised systems to find and obtain insecurely stored credentials.
T1552.001 Credentials In Files Credential Access
Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials.
T1552.002 Credentials in Registry Credential Access
Adversaries may search the Registry on compromised systems for insecurely stored credentials.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2025-30208Same product: Vitejs Vite
CVE-2025-31125Same product: Vitejs Vite
CVE-2025-58751Same product: Vitejs Vite
CVE-2025-58752Same product: Vitejs Vite
CVE-2025-24010Same product: Vitejs Vite
CVE-2023-49293Same product: Vitejs Vite
CVE-2025-46565Same product: Vitejs Vite
CVE-2026-39363Same product: Vitejs Vite
CVE-2024-23331Same product: Vitejs Vite
CVE-2026-53571Same product: Vitejs Vite

Affected Assets

vitejs
vite
2.9.15 · 3.0.2 — 3.2.7 · 4.0.0 — 4.0.5 · 4.1.0 — 4.1.5

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)
  • 7 hardening rules · 6 OS baselines
Validate
Prove the fix (OWASP ASVS)
  • V10.4.9
  • V11.7.1
  • V14.1.2
  • V14.2.4

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-200

Automated marking applies security attributes to system outputs, making it harder for attackers to exploit unmarked sensitive information leading to unauthorized exposure.

addresses: CWE-200

Proper attribute retention and permitted-value enforcement limits unauthorized actors from accessing sensitive information lacking correct labels.

addresses: CWE-200

Prevents unauthorized exposure of sensitive information by prohibiting untrusted external systems from processing or storing it.

addresses: CWE-200

By enforcing authorization matching prior to sharing, the control reduces the risk of exposing sensitive information to unauthorized actors.

addresses: CWE-200

Review and removal of nonpublic information from publicly accessible systems directly prevents exposure of sensitive data to unauthorized actors.

addresses: CWE-200

Data mining protection mechanisms detect and block unauthorized bulk extraction of sensitive data, directly mitigating exposure to unauthorized actors.

addresses: CWE-200

Literacy training teaches users to recognize and avoid actions that result in unauthorized exposure of sensitive information.

addresses: CWE-200

Retaining and monitoring training records confirms personnel have completed privacy and security awareness training on handling sensitive data, reducing the chance of unauthorized exposure due to lack of knowledge.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-05 mostly match
prevents

PR.AA-05 directly enforces least-privilege authorization that blocks most unauthorized disclosures, yet CWE-200 also arises from logging, error messages, and side-channel paths that access controls alone do not address.

PR.DS-10 mostly match
prevents

PR.DS-10 mostly prevents CWE-200 by directly eliminating unauthorized access to sensitive data-in-use, yet only partially addresses the weakness because CWE-200 spans many other exposure vectors outside runtime protection.

PR.IR-01 mostly match
prevents

PR.IR-01's segmentation/zero-trust controls largely eliminate network-level unauthorized access paths that enable exposure, yet CWE-200 spans many additional vectors (API responses, logs, app logic) that network controls alone cannot close.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly require path-input validation and canonicalization that prevent this equivalence flaw.

PR.AA-01 partial match
prevents

PR.AA-01 supplies proper credential lifecycle controls that reduce unauthorized access paths, yet leaves many other exposure vectors (error messages, logging, side channels, etc.) unaddressed.

PR.AA-03 partial match
prevents

Authentication verifies actor identity and is a prerequisite for access decisions, yet addresses only one facet of the broad set of exposure vectors in CWE-200.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

prevents

Restricting anonymous or unknown access and encrypting high-value information limits the exposure of sensitive data that would otherwise be obtainable by unauthorized actors.

prevents

Suppressing system details, error specifics, and previous log-on information until successful authentication reduces the information an unauthenticated attacker can gather.

prevents

By requiring owners to assign sensitivity labels and corresponding handling rules, the control ensures that information is not left unmarked and therefore reduces the chance that sensitive data will be exposed to unauthorized actors.

prevents

Requiring encryption, access controls, and recipient authentication for transfers directly reduces the chance that sensitive data reaches an unauthorized observer.

prevents

Secure delivery, protected storage, and confidentiality of allocation records limit exposure of authentication material to unauthorized observers.

prevents

Requiring defined procedures, assigned roles, and technical/organizational measures for handling PII reduces the chance that sensitive personal data will be exposed to unauthorized actors through inadequate handling or missing safeguards.

Hardening callouts derived

Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).

Ubuntu 22.04 (1 rule)
  • V-260470 Ubuntu 22.04 LTS, when booted, must require authentication upon booting into single-user and maintenance modes. prevents CWE-200
Ubuntu 24.04 (2 rules)
  • V-270647 Ubuntu 24.04 LTS must not have the telnet package installed. prevents CWE-200
  • V-270675 Ubuntu 24.04 LTS when booted must require authentication upon booting into single-user and maintenance modes. prevents CWE-200
Windows 10 (1 rule)
  • V-220737 Administrative accounts must not be used with applications that access the Internet, such as web browsers, or with potential Internet sources, such as email. prevents CWE-200
Windows Server 2016 (1 rule)
  • V-224974 Domain-created Active Directory Organizational Unit (OU) objects must have proper access control permissions. prevents CWE-200
Windows Server 2019 (1 rule)
  • V-205743 Windows Server 2019 organization created Active Directory Organizational Unit (OU) objects must have proper access control permissions. prevents CWE-200
Windows Server 2022 (1 rule)
  • V-254395 Windows Server 2022 organization created Active Directory Organizational Unit (OU) objects must have proper access control permissions. prevents CWE-200

References