Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

build: update dependency vite to v5.0.5 [security] #26590

Merged
merged 1 commit into from
Dec 6, 2023
Merged

build: update dependency vite to v5.0.5 [security] #26590

merged 1 commit into from
Dec 6, 2023

Conversation

angular-robot
Copy link
Collaborator

This PR contains the following updates:

Package Type Update Change
vite (source) dependencies patch 5.0.4 -> 5.0.5
vite (source) devDependencies patch 5.0.4 -> 5.0.5

GitHub Vulnerability Alerts

CVE-2023-49293

Summary

When Vite's HTML transformation is invoked manually via server.transformIndexHtml, the original request URL is passed in unmodified, and the html being transformed contains inline module scripts (<script type="module">...</script>), it is possible to inject arbitrary HTML into the transformed output by supplying a malicious URL query string to server.transformIndexHtml.

Impact

Only apps using appType: 'custom' and using the default Vite HTML middleware are affected. The HTML entry must also contain an inline script. The attack requires a user to click on a malicious URL while running the dev server. Restricted files aren't exposed to the attacker.

Patches

Fixed in vite@5.0.5, vite@4.5.1, vite@4.4.12

Details

Suppose index.html contains an inline module script:

<script type="module">
  // Inline script
</script>

This script is transformed into a proxy script like

<script type="module" src="/index.html?html-proxy&index=0.js"></script>

due to Vite's HTML plugin:

https://github.com/vitejs/vite/blob/7fd7c6cebfcad34ae7021ebee28f97b1f28ef3f3/packages/vite/src/node/plugins/html.ts#L429-L465

When appType: 'spa' | 'mpa', Vite serves HTML itself, and htmlFallbackMiddleware rewrites req.url to the canonical path of index.html,

https://github.com/vitejs/vite/blob/73ef074b80fa7252e0c46a37a2c94ba8cba46504/packages/vite/src/node/server/middlewares/htmlFallback.ts#L44-L47

so the url passed to server.transformIndexHtml is /index.html.

However, if appType: 'custom', HTML is served manually, and if server.transformIndexHtml is called with the unmodified request URL (as the SSR docs suggest), then the path of the transformed html-proxy script varies with the request URL. For example, a request with path / produces

<script type="module" src="/@&#8203;id/__x00__/index.html?html-proxy&index=0.js"></script>

It is possible to abuse this behavior by crafting a request URL to contain a malicious payload like

"></script><script>alert('boom')</script>

so a request to http://localhost:5173/?%22%3E%3C/script%3E%3Cscript%3Ealert(%27boom%27)%3C/script%3E produces HTML output like

<script type="module" src="/@&#8203;id/__x00__/?"></script><script>alert("boom")</script>?html-proxy&index=0.js"></script>

which demonstrates XSS.

PoC

Detailed Impact

This will probably predominantly affect development-mode SSR, where vite.transformHtml is called using the original req.url, per the docs:

https://github.com/vitejs/vite/blob/7fd7c6cebfcad34ae7021ebee28f97b1f28ef3f3/docs/guide/ssr.md?plain=1#L114-L126

However, since this vulnerability affects server.transformIndexHtml, the scope of impact may be higher to also include other ad-hoc calls to server.transformIndexHtml from outside of Vite's own codebase.

My best guess at bisecting which versions are vulnerable involves the following test script

import fs from 'node:fs/promises';
import * as vite from 'vite';

const html = `
<!DOCTYPE html>
<html lang="en">
  <head>
    <meta charset="UTF-8" />
  </head>
  <body>
    <script type="module">
      // Inline script
    </script>
  </body>
</html>
`;
const server = await vite.createServer({ appType: 'custom' });
const transformed = await server.transformIndexHtml('/?%22%3E%3C/script%3E%3Cscript%3Ealert(%27boom%27)%3C/script%3E', html);
console.log(transformed);
await server.close();

and using it I was able to narrow down to #​13581. If this is correct, then vulnerable Vite versions are 4.4.0-beta.2 and higher (which includes 4.4.0).

Release Notes

vitejs/vite (vite)

v5.0.5

Compare Source

Configuration

📅 Schedule: Branch creation - "" in timezone America/Tijuana, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

@angular-robot angular-robot added action: merge The PR is ready for merge by the caretaker target: minor This PR is targeted for the next minor release labels Dec 6, 2023
@angular-robot angular-robot bot added the area: build & ci Related the build and CI infrastructure of the project label Dec 6, 2023
@clydin clydin added target: patch This PR is targeted for the next patch release target: minor This PR is targeted for the next minor release and removed target: minor This PR is targeted for the next minor release target: patch This PR is targeted for the next patch release labels Dec 6, 2023
@clydin clydin mentioned this pull request Dec 6, 2023
Merged
@alan-agius4 alan-agius4 merged commit bf08da7 into angular:main Dec 6, 2023
37 checks passed
@alan-agius4 alan-agius4 deleted the ng-renovate/npm-vite-vulnerability branch December 6, 2023 06:43
alan-agius4 added a commit to alan-agius4/angular-cli that referenced this pull request Dec 6, 2023
@alan-agius4
build: update dependency vite to v4.5.1
bed80c4 
16.2.x variant of angular#26590
alan-agius4 added a commit to alan-agius4/angular-cli that referenced this pull request Dec 6, 2023
@alan-agius4
build: update dependency vite to v4.5.1
3bab05f 
16.2.x variant of angular#26590
@alan-agius4 alan-agius4 mentioned this pull request Dec 6, 2023
Merged
clydin pushed a commit that referenced this pull request Dec 6, 2023
@alan-agius4 @clydin
build: update dependency vite to v4.5.1
e0e011f 
16.2.x variant of #26590
@angular-automatic-lock-bot
Copy link

This issue has been automatically locked due to inactivity.
Please file a new issue if you are encountering a similar or related problem.

Read more about our automatic conversation locking policy.

This action has been performed automatically by a bot.

@angular-automatic-lock-bot angular-automatic-lock-bot bot locked and limited conversation to collaborators Jan 6, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Reviewers

@clydin clydin clydin approved these changes

Assignees
No one assigned
Labels
action: merge The PR is ready for merge by the caretaker area: build & ci Related the build and CI infrastructure of the project target: minor This PR is targeted for the next minor release
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@angular-robot @clydin @alan-agius4