GHSA-g239-q96q-x4qm: @vitejs/plugin-rsc has an Arbitrary File Read via `/__vite_rsc_findSourceMapURL` Endpoint
SummaryThe `/__vite_rsc_findSourceMapURL` endpoint in `@vitejs/plugin-rsc` allows **unauthenticated arbitrary file read** during development mode. An attacker can read any file accessible to the Node.js process by sending a crafted HTTP request with a `file://` URL in the `filename` query parameter.**Severity:** High
**Attack Vector:** Network  
**Privileges Required:** None  
**Scope:** Development mode only (`vite dev`)ImpactWho Is Affected?**All developers** using `@vitejs/plugin-rsc` during developmentProjects running `vite dev` with the RSC plugin enabledAttack Scenarios**Network-Exposed Dev Servers:**  
When developers run `vite --host 0.0.0.0` (common for mobile testing), attackers on the same network can read files.~**XSS-Based Attacks:**~
~If the application has an XSS vulnerability, malicious JavaScript can fetch sensitive files and exfiltrate them.~~**Malicious Dependencies:** ~
~A compromised npm package could include code that reads files during development.~~**DNS Rebinding:**~ (EDIT: This doesn't apply since https://github.com/vitejs/vite/pull/20222)
~An attacker could use DNS rebinding to access the localhost dev server from a malicious website.~What Can Be Leaked?Environment files (`.env`, `.env.local`, `.env.production`)SSH keys (`~/.ssh/id_rsa`, `~/.ssh/id_ed25519`)Cloud credentials (`~/.aws/credentials`, `~/.config/gcloud/`)Database passwords and API keysSource code from other projectsSystem files (`/etc/passwd`, `/etc/shadow` if readable)DetailsVulnerable Code Location**File:** `packages/plugin-rsc/src/plugins/find-source-map-url.ts`  
**Lines:** 49-61The vulnerability exists in the `findSourceMapURL` function:Root CauseThe endpoint:Accepts a user-controlled `filename` parameter from the query string (line 20)Checks if it starts with `file://` (line 49)Converts it to a filesystem path using `fileURLToPath()` (line 50)Reads the file with `fs.readFileSync()` **without any path validation** (line 53)Returns the file contents in the JSON response (line 57)**No validation is performed** to ensure the requested file is within the project directory or is a legitimate source file.PoCQuick Test (Single Command)If you have a Vite dev server running with `@vitejs/plugin-rsc`, you can test immediately:**Expected output** (file contents in `sourcesContent`):Complete PoC with DockerFor a fully reproducible environment, I've prepared a complete PoC:Step 1: Create a minimal `vite.config.ts`Step 2: Create `package.json`Step 3: Create minimal `index.html` and `src/main.tsx`**index.html:****src/main.tsx:**Step 4: Start the server and exploitPython Exploit ScriptFor easier testing, here's a Python script:**Usage:**Verified Exploitation ResultsI tested this in a Docker container and successfully read:| File | Description |
|------|-------------|
| `/etc/passwd` | System user accounts |
| `/etc/hosts` | Network configuration |
| `/root/.env.secret` | Environment secrets |
| `/root/.ssh/id_rsa` | SSH private keys |
| `/proc/self/environ` | Process environment variables |
| Source code files | Any file in the filesystem |**Example output from `/etc/passwd`:****Example output from sensitive secrets file:**
CVSS v3.1: 7.5