Description

I previously disclosed an arbitrary file read due to Vite misconfiguration. This is a similar vulnerability with less impact.

Proof of Concept

Start any nuxt app in dev.

Browse to:

• http://localhost:3000/__nuxt_vite_node__/module/C:/Windows/System32/calc.exe
• http://localhost:3000/__nuxt_vite_node__/module//bin/passwd

Observe content of the file is leaked.

Notes

Not exactly certain how this works but only seems to work for binary files or sometimes files with tabs (but I couldn't always reproduce this). Some file extensions don't work. For these reasons I gave confidentiality: Low Only works when server is running in dev.

Impact

Read almost any file on the file system when using the development server. Great primitive for detecting installed software as reading binaries is easy.

Can leak runtime config easily with this, but it's unlikely to contain anything important on dev (hopefully).

The bug seems to exist within pretty much every version of nuxt from RC-8, but seems to fail on the Majority of Vite versions rather than leak the content in the error.