Summary
@vitest/mocker registers a redirect mock's target path without validating it
against the dev server's file-serving allowlist. An attacker who can reach the
dev server's WebSocket can register a redirect mock pointing outside the project
root; when the mocked module is requested, the plugin's load hook returns
readFile(<attacker path>) as the module source, disclosing local files.
This is exploitable without authentication only through the public
mockerPlugin / standalone interceptorPlugin exports (used by third-party dev
servers), which register the handler on Vite's unauthenticated HMR socket.
Vitest's own browser mode registers mocks over a token-authenticated RPC and
is not remotely reachable by default (see Scope).
Affected code
packages/mocker/src/node/interceptorPlugin.ts.
The load hook is the file-read sink:
if (mock.type === 'redirect') {
return readFile(mock.redirect, 'utf-8')
}mock.redirect is derived from client input at registration time with no
boundary check:
if (event.type === 'redirect') {
const redirectUrl = new URL(event.redirect)
event.redirect = join(server.config.root, redirectUrl.pathname)
}
registry.register(event)There is no server.fs.allow / server.fs.deny check and no assertion that the
resolved path stays within the project root.
Registration paths and trust boundaries
- Public
mockerPlugin / interceptorPlugin (unauthenticated). In
configureServer, the plugin registers server.ws.on('vitest:interceptor:register', …)
on Vite's HMR WebSocket. That socket performs no token, Origin, or same-origin
check, so any client that can reach it can register a redirect mock. This is
the path the "unauthenticated" impact applies to.
- Vitest browser mode (authenticated). Mocks register over the browser RPC
(registerMock), which sits behind a per-run token (isValidApiRequest, a
random api.token). The interceptor's configureServer socket is not used for
registration here (in v5 it does not run at all, as the plugin is injected per
environment). The same missing boundary check exists on the authenticated RPC
path, but reaching it requires the token, so it is not a remote-unauthenticated
read.
Path handling
new URL(redirect).pathname combined with join(root, pathname) does not
confine reads to the root:
- Special/hierarchical schemes (
file:, http:) are normalized by WHATWG URL,
so .. segments are collapsed and the result stays under the root. Payloads of
the form file:///../../etc/passwd do not escape.
- A non-special (opaque) scheme preserves
.. in pathname, so
join(root, "../../…/etc/passwd") resolves outside the root and reads an
arbitrary file.
Even without escaping the root, the missing server.fs check allows reading any
in-root file the dev server would otherwise refuse to serve (for example an
in-root .env or source that is denied by server.fs.deny).
Scope / preconditions
- This is a development-server issue. The dev server binds to
localhost by
default and is not reachable from the network unless the developer exposes it
(server.host / 0.0.0.0, a LAN bind, or a proxy).
- A raw (non-browser) client against a reachable server bypasses browser origin
and CORS protections entirely and can both register the mock and read the
response.
- A browser-based drive-by against a localhost server is substantially mitigated
by Vite defaults: the default CORS origin allowlist is limited to localhost
origins, and server.allowedHosts blocks DNS-rebinding, so a cross-origin page
cannot read the file contents back.
Impact
Disclosure of local files readable by the dev-server process (source, in-root
.env/secrets, and, via the opaque-scheme payload, files outside the project
root). No integrity or availability impact.
Affected versions
Present since @vitest/mocker was introduced.
- Affected:
@vitest/mocker >= 2.1.0 (shipped in vitest and
@vitest/browser >= 2.1.0), through 4.1.x and the 5.0.0 pre-releases.
- Fixed: Vitest 4.1.11 and 5.0.0. Older majors (2.1.x, 3.x) are not
maintained and are not planned to receive the fix.
Fix
Validate the resolved redirect target against Vite's file-serving allowlist
(isFileLoadingAllowed) before registering it, at every registration site, and
stop registering the interceptor WebSocket events in Vitest's browser mode
(mocks there flow through the authenticated RPC).
References
1491342590 Reporter
Summary
@vitest/mockerregisters a redirect mock's target path without validating itagainst the dev server's file-serving allowlist. An attacker who can reach the
dev server's WebSocket can register a redirect mock pointing outside the project
root; when the mocked module is requested, the plugin's
loadhook returnsreadFile(<attacker path>)as the module source, disclosing local files.This is exploitable without authentication only through the public
mockerPlugin/ standaloneinterceptorPluginexports (used by third-party devservers), which register the handler on Vite's unauthenticated HMR socket.
Vitest's own browser mode registers mocks over a token-authenticated RPC and
is not remotely reachable by default (see Scope).
Affected code
packages/mocker/src/node/interceptorPlugin.ts.The
loadhook is the file-read sink:mock.redirectis derived from client input at registration time with noboundary check:
There is no
server.fs.allow/server.fs.denycheck and no assertion that theresolved path stays within the project root.
Registration paths and trust boundaries
mockerPlugin/interceptorPlugin(unauthenticated). InconfigureServer, the plugin registersserver.ws.on('vitest:interceptor:register', …)on Vite's HMR WebSocket. That socket performs no token, Origin, or same-origin
check, so any client that can reach it can register a redirect mock. This is
the path the "unauthenticated" impact applies to.
(
registerMock), which sits behind a per-run token (isValidApiRequest, arandom
api.token). The interceptor'sconfigureServersocket is not used forregistration here (in v5 it does not run at all, as the plugin is injected per
environment). The same missing boundary check exists on the authenticated RPC
path, but reaching it requires the token, so it is not a remote-unauthenticated
read.
Path handling
new URL(redirect).pathnamecombined withjoin(root, pathname)does notconfine reads to the root:
file:,http:) are normalized by WHATWG URL,so
..segments are collapsed and the result stays under the root. Payloads ofthe form
file:///../../etc/passwddo not escape...inpathname, sojoin(root, "../../…/etc/passwd")resolves outside the root and reads anarbitrary file.
Even without escaping the root, the missing
server.fscheck allows reading anyin-root file the dev server would otherwise refuse to serve (for example an
in-root
.envor source that is denied byserver.fs.deny).Scope / preconditions
localhostbydefault and is not reachable from the network unless the developer exposes it
(
server.host/0.0.0.0, a LAN bind, or a proxy).and CORS protections entirely and can both register the mock and read the
response.
by Vite defaults: the default CORS origin allowlist is limited to
localhostorigins, and
server.allowedHostsblocks DNS-rebinding, so a cross-origin pagecannot read the file contents back.
Impact
Disclosure of local files readable by the dev-server process (source, in-root
.env/secrets, and, via the opaque-scheme payload, files outside the projectroot). No integrity or availability impact.
Affected versions
Present since
@vitest/mockerwas introduced.@vitest/mocker>= 2.1.0 (shipped invitestand@vitest/browser>= 2.1.0), through 4.1.x and the 5.0.0 pre-releases.maintained and are not planned to receive the fix.
Fix
Validate the resolved redirect target against Vite's file-serving allowlist
(
isFileLoadingAllowed) before registering it, at every registration site, andstop registering the interceptor WebSocket events in Vitest's browser mode
(mocks there flow through the authenticated RPC).
References