Vite dev server arbitrary file read via WebSocket access control bypass

This repository is a small standalone Python PoC for CVE-2026-39363 / GHSA-p9ff-h696-f583 affecting Vite dev server. It contains two files: a README describing the vulnerability, affected versions, usage, and mitigation guidance; and exp.py, the actual exploit implementation. The exploit is not part of a larger framework. The core capability is unauthenticated arbitrary file read from the host running a vulnerable Vite dev server. The script manually implements a WebSocket client using only Python standard library modules (socket, ssl, struct, hashlib, base64, json, urllib.parse, etc.). It connects to the target HMR WebSocket, performs a handshake with Sec-WebSocket-Protocol: vite-hmr, intentionally omits the Origin header to bypass token enforcement, then sends a custom vite:invoke event that calls the server-side fetchModule method with a file:// URL ending in ?raw. This causes the server to read local files and return their contents as transformed module code, bypassing the normal HTTP-layer server.fs.allow restriction. Repository structure is simple: README.md documents the vulnerability and gives example commands; exp.py is the entry point and contains helper routines for file path to file:// conversion, WebSocket frame send/receive, handshake validation, response parsing, and optional saving of retrieved content to an output directory. The exploit supports both HTTP and HTTPS targets, custom Host headers for allowedHosts edge cases, custom HMR WebSocket paths, multiple file reads in one run, and both POSIX and Windows path formats. This is a real exploit rather than a detector. It does not deliver code execution; instead, its payload is a crafted WebSocket JSON message that exfiltrates arbitrary file contents. Because it includes a working end-to-end exploit path and usable operator options, its maturity is best classified as OPERATIONAL.

Repository contains two Python exploit scripts, one for single-target exploitation and one for batch scanning/exploitation, plus a small target list file and a README. The code targets a Vite development server vulnerability labeled CVE-2026-39363. The exploitation flow is consistent across both scripts: request /@vite/client over HTTPS, parse the returned JavaScript to extract a wsToken, establish a WSS connection to the Vite HMR endpoint using the token and subprotocol vite-hmr, then send a crafted JSON message with event vite:invoke and name fetchModule to request file:///etc/passwd?raw from the remote host. Returned WebSocket messages are collected and written to local files. The single-target script prompts for a hostname, assumes port 5173, and is heavily instrumented for debugging: it prints request/response headers, saves all messages, filters out the default connected message, and records status. The batch script reads host:port pairs from 1.txt, iterates through targets, stores per-target output under ws_results/, and classifies successful responses by searching for the keyword 'root', indicating likely disclosure of /etc/passwd contents. Both scripts are designed to run through a local Burp Suite proxy at 127.0.0.1:8080 and explicitly disable TLS certificate validation to accommodate interception. Overall purpose: operational proof-of-concept exploit for arbitrary local file read against exposed Vite dev servers via the HMR WebSocket interface. It is not merely a detector because it actively sends an exploitation payload and attempts to retrieve sensitive file contents.

This repository is a working proof-of-concept exploit for CVE-2026-39363, an arbitrary file read issue in vulnerable Vite Dev Server versions. The exploit abuses the Vite HMR WebSocket interface by invoking the custom RPC method fetchModule with attacker-controlled file paths. The core capability is remote file disclosure: after obtaining a wsToken from /@vite/client, the exploit connects to the Vite WebSocket endpoint using the vite-hmr subprotocol and requests local files via file:// URLs, absolute paths, and /@fs/ path variants. If the target server is exposed and its server.fs.allow policy is permissive, the server returns file contents. Repository structure is split between exploit code and a demo vulnerable application. The main exploit artifacts are exp.py and poc.js. exp.py is a Python exploit that scans for an open Vite port, fetches the wsToken over HTTP, and then leverages a Node-based workflow/output parsing to retrieve file contents; the provided excerpt shows token retrieval, port probing, and CLI handling. poc.js is a direct Node.js WebSocket exploit that connects to the Vite HMR socket, sends multiple fetchModule path variants, handles ping/pong and invoke responses, and prints disclosed file contents. README.md documents the vulnerability, exploitation flow, affected versions, manual exploitation steps, and remediation guidance. The rest of the repository is a Vite demo project used to reproduce the issue: package.json pins vite 6.2.2 and includes ws, vite.config.js intentionally weakens filesystem restrictions by allowing C:/ and E:/, index.html and src/* contain standard demo frontend assets, and public/* contains static SVG resources. This is not a detection-only repository and not a framework module; it is an operational PoC/demo exploit for network-accessible Vite development servers.