CVE-2023-34092: Vite provides frontend tooling. Prior to versions 2.9.16, 3.2.7, 4.0.5, 4.1.5, 4.2.3, and 4.3.9, Vite Server Options (`server.fs.deny`) can be bypassed using…

PriorityP259high7.5CVSS 3.1

AVNACLPRNUINSUCHINAN

EXPLOIT

EPSS

3.15%

86.3th percentile

Vite provides frontend tooling. Prior to versions 2.9.16, 3.2.7, 4.0.5, 4.1.5, 4.2.3, and 4.3.9, Vite Server Options (`server.fs.deny`) can be bypassed using double forward-slash (//) allows any unauthenticated user to read file from the Vite root-path of the application including the default `fs.deny` settings (`['.env', '.env.*', '*.{crt,pem}']`). Only users explicitly exposing the Vite dev server to the network (using `--host` or `server.host` config option) are affected, and only files in the immediate Vite project root folder could be exposed. This issue is fixed in [email protected], [email protected], [email protected], [email protected], [email protected], and [email protected].

Affected

24 ranges

Vendor	Product	Version range	Fixed in
vitejs	vite	—	—
vitejs	vite	—	—
vitejs	vite	—	—
vitejs	vite	—	—
vitejs	vite	—	—
vitejs	vite	>= 0 < 2.9.16	2.9.16
vitejs	vite	>= 2.7.0 < 2.9.17	2.9.17
vitejs	vite	>= 2.7.0 < 2.9.17	2.9.17
vitejs	vite	>= 3.0.0 < 3.2.8	3.2.8
vitejs	vite	>= 3.0.0 < 3.2.8	3.2.8
vitejs	vite	>= 3.0.2 < 3.2.7	3.2.7
vitejs	vite	>= 3.0.2 < 3.2.7	3.2.7
vitejs	vite	>= 4.0.0 < 4.5.2	4.5.2
vitejs	vite	>= 4.0.0 < 4.0.5	4.0.5
vitejs	vite	>= 4.0.0 < 4.5.2	4.5.2
vitejs	vite	>= 4.0.0 < 4.0.5	4.0.5
vitejs	vite	>= 4.1.0 < 4.1.5	4.1.5
vitejs	vite	>= 4.1.0 < 4.1.5	4.1.5
vitejs	vite	>= 4.2.0 < 4.2.3	4.2.3
vitejs	vite	>= 4.2.0 < 4.2.3	4.2.3
vitejs	vite	>= 4.3.0 < 4.3.9	4.3.9
vitejs	vite	>= 4.3.0 < 4.3.9	4.3.9
vitejs	vite	>= 5.0.0 < 5.0.12	5.0.12
vitejs	vite	>= 5.0.0 < 5.0.12	5.0.12

Detection & IOCsextracted from sources · hover to see the quote

url{{BaseURL}}//.env

path//.env

other/@vite/client

→Probe for CVE-2023-34092 by first requesting /.env and confirming a 403, then requesting //.env (double forward-slash) and checking for HTTP 200 with 'VITE_APP_SECRET' in the response body.
→The bypass uses double forward-slash paths (//) to circumvent the server.fs.deny blacklist on exposed Vite dev servers.
→Identify exposed Vite dev servers via FOFA or Shodan using the /@vite/client fingerprint in the HTTP response body.
→A similar bypass (CVE-2024-23331) uses case-augmented filenames on case-insensitive filesystems (e.g., Windows); the same server.fs.deny blacklist is evaded. ↗

·Only exposed Vite dev servers are affected; production builds are not vulnerable.
·The detection flow requires a two-step confirmation: /.env must return 403 first, then //.env must return 200 with the secret keyword — both conditions must be met to avoid false positives.
·The related CVE-2024-23331 variant only affects hosts with case-insensitive filesystems (notably Windows), whereas CVE-2023-34092 uses the double-slash path bypass regardless of OS. ↗

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

ghsa7.5HIGH

osv7.5HIGH

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.