Vitest Path Traversal Vulnerability Allowing Arbitrary File Read and Remote Code Execution

A vulnerability in Vitest's UI/API server on Windows prior to versions 3.2.5 and 4.1.0 allows for path traversal attacks. By exploiting the incorrect handling of file serving permissions, an attacker can read files outside the project directory. Additionally, the exposed API features for writing and re-running tests could be misused to execute arbitrary scripts. This vulnerability arises when the Vitest UI server is exposed to the network, particularly on Windows systems.

Impact

Exploitation of this vulnerability could lead to unauthorized file access and execution of arbitrary scripts on the victim's machine.

Reproduction

To reproduce this vulnerability, first run the Vitest UI server and ensure it is exposed to the network. Then, send a request to the '/__vitest_attachment__' endpoint, including a file path that leverages the path traversal exploit. The response will contain the contents of the traversed file, demonstrating the successful exploitation of the vulnerability.

Remediation

Users can update to Vitest versions 3.2.5 or 4.1.0, where this vulnerability has been patched. After updating, be cautious when re-enabling the 'allowWrite' and 'allowExec' options, as they can introduce similar risks if the UI is exposed to the network.