中文 | English

Vite Dev Server Vulnerability Scanner

一个内外网通吃的自动化扫描器

An automated tool for scanning Vite development server vulnerabilities. This tool utilizes the FOFA API to collect potential targets and automatically detects specific vulnerabilities.

Features

• Auto

  • Automatic target asset collection via FOFA
  • Multi-threaded concurrent scanning
  • Automatic CSV report generation

• Manual

  • Manual target asset collection via CIDR
  • Multi-threaded concurrent scanning
  • Import targets from TXT
  • Import payload from TXT
  • Automatic CSV report generation

Screenshots - Auto Mode

Screenshots - Manual Mode

Requirements

• Python 3
• FOFA API account

Vulnerability Details

CVE-2025-30208

• Vulnerability Name: Vite Dev Server Unauthorized Access
• Description: The Vite development server contains an unauthorized access vulnerability that allows attackers to access sensitive information through specific URLs.
• Affected Versions: Vite versions >=6.2.0, <=6.2.2, >=6.1.0, <=6.1.1, >=6.0.0, <=6.0.11, >=5.0.0, <=5.4.14, <=4.5.9
• In plain terms: server.fs.deny is a configuration option in the Vite development server that restricts access to the server's file system. This option allows developers to set an array of regular expressions to block access to specific files. While this is an important security feature designed to prevent unauthorized access to sensitive files on the server, the mechanism can be bypassed by appending ?raw?? or ?import&raw?? to the URL. If the target file exists, its contents can be directly accessed. This leads to the following potential security risks:
  • Reading arbitrary files on the server
  • Accessing system configuration files
  • Obtaining sensitive application information
  • Probing server directory structure

CVE-2025-31125

• Vulnerability Name: Vite Dev Server Arbitrary File Read via Import
• Description: The Vite development server contains an arbitrary file read vulnerability that allows attackers to read sensitive files through the import mechanism.
• Affected Versions: Vite versions >=6.2.0, <=6.2.2, >=6.1.0, <=6.1.1, >=6.0.0, <=6.0.11, >=5.0.0, <=5.4.14, <=4.5.9
• In plain terms: The vulnerability exists in the Vite development server's import mechanism. Attackers can bypass file access restrictions by appending ?import&?inline=1.wasm?init to the URL. This allows reading arbitrary files on the server, including:
  • System files (e.g., /etc/passwd on Linux, C:/Windows/win.ini on Windows)
  • Application configuration files
  • Source code files
  • Database credentials
  • Environment variables

Configuration

Create a .env file in the project root directory with the following content:

[email protected]
FOFA_KEY=your_fofa_api_key
COUNTRY=AU

Common country codes:

• CN: China
• US: United States
• AU: Austrailia
• DE: Germany
• CA: Canada
• FR: France
• GB: United Kingdom
• IN: India
• JP: Japan
• RU: Russia
• ZA: South Africa
• BR: Brazil
• MX: Mexico
• ES: Spain
• ...etc

Usage - FOFA

pip install -r requirements.txt
python main.py

Usage - CIDR

# Install dependencies
pip install -r requirements.txt
# Get help
python manual.py -h

usage: manual.py [-h] [-t TARGETS] [-f FILE] [-p PORTS] [-d DICT]

Vite Dev Server Vulnerability Scanner - Manual Mode

options:
  -h, --help            show this help message and exit
  -t TARGETS, --targets TARGETS
                        Target IP addresses, supports single IP, CIDR format (e.g., 192.168.1.0/24) or
                        domain, separate multiple targets with commas
  -f FILE, --file FILE  Load targets from file (one target per line)
  -p PORTS, --ports PORTS
                        Port list, separate with commas (default: 80,443,3000,5173,8080)
  -d DICT, --dict DICT  Custom dictionary file path (format: one path per line, lines starting with #
                        are ignored)
# Scan 192.168.1.0/24 with default ports
python manual.py -t 192.168.1.0/24

Configuration Parameters

The following parameters can be adjusted in main.py:

• MAX_PAGE: Maximum number of query pages (default: 5)
• RESULTS_PER_PAGE: Results per page (default: 100)
• TIMEOUT: Request timeout in seconds (default: 10)
• MAX_THREADS: Maximum concurrent threads (default: 20)

Output

Scan results will be saved in vite_vulnerable_targets.csv with the following fields:

• url: Target URL
• vulnerable_url: Vulnerability URL
• status_code: HTTP status code
• domain: Domain name
• ip: IP address
• content_preview: First 200 characters of the vulnerable content
• vulnerability_type: Either "CVE-2025-30208" or "CVE-2025-31125"

At the end of the scan, the tool will display hit rate statistics:

• Total targets scanned
• Number of CVE-2025-30208 hits and hit rate percentage
• Number of CVE-2025-31125 hits and hit rate percentage
• Total number of vulnerabilities found

Example output:

[+] Scan complete!
[*] Total targets scanned: 100
[*] CVE-2025-30208 hits: 15 (15.00%)
[*] CVE-2025-31125 hits: 8 (8.00%)
[*] Total vulnerabilities found: 23

Disclaimer

This tool is intended for security research and authorized testing only. Do not use for illegal purposes. Ensure you have proper authorization before testing any targets.

License

MIT License

References

• NIST 30208
• NIST 31125
• Github Security Advisory - GHSA-x574-m823-4x7w
• Github Security Advisory - GHSA-4r4m-qw57-chr8
• Vite Commit - Fix: prevent arbitrary file read via import