Information Disclosure Vulnerability in @cloudflare/vite-plugin: Secrets Exposed via Dev Server
Summary
GHSA-4pfg-2mw5-f8jx: Cloudflare Vite plugin exposes secrets over the built-in dev server. Affects @cloudflare/vite-plugin versions < 1.6.0. Fixed in 1.6.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @cloudflare/vite-plugin is a tool designed to enhance the development experience for Cloudflare Workers projects by integrating Vite's fast build and hot-reload capabilities. However, in its default configuration, it exposes sensitive files through the local development server, which can lead to significant security risks if not properly managed.
Vulnerability Detail
The vulnerability arises from the default configuration of the @cloudflare/vite-plugin, which allows all files, including sensitive ones like .env and .dev.vars, to be accessed via the local development server. This exposure can lead to unauthorized access to secrets and sensitive information if the development server is accessible over a public network. Attackers can exploit this by sending HTTP requests to the server, potentially leading to data breaches and further vulnerabilities.
How To Fix
Minimum fixed version
1.6.0
This is the first release that contains the fix.
npm install @cloudflare/vite-plugin@1.6.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid exposing the development server to the public by binding it to localhost only. You can do this by running the development server with the following command: npm run dev -- --host localhost. This will prevent external access to sensitive files.
Conclusion
The @cloudflare/vite-plugin has a vulnerability that can expose sensitive files through its development server. It is crucial to update to the latest version to mitigate this risk. Additionally, using workarounds to restrict server access can help protect sensitive information until an update can be applied.
See every vulnerability recorded for @cloudflare/vite-plugin →
FAQ
Files such as .env, .dev.vars, package.json, and README.md can be exposed, potentially revealing sensitive information and project dependencies.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update the package right away, ensure that your development server is not accessible from the public internet by restricting access to localhost.
The vulnerability is classified as moderate, but it can lead to significant risks if sensitive information is exposed, especially in production environments.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in your software using just package-lock.json, providing real-time insights without requiring code access.
