CVE-2025-31125: Vite Dev Server Improper Access Control

union DeviceNetworkEvents, DeviceFileEvents, W3CIISLog
| where TimeGenerated > ago(7d)
| where (
    (csUriStem contains "/@fs/" and (csUriStem contains ".." or csUriStem contains "%2e%2e" or csUriStem contains "/etc/" or csUriStem contains "/proc/" or csUriStem contains "/.env" or csUriStem contains "/passwd"))
    or (csUriStem contains "/__vite_ping" and csMethod =~ "GET")
    or (csUriStem matches regex @"/@fs/[a-zA-Z]:[\\/]" )
    or (csUriStem contains "/@fs/" and csUriStem !startswith "/@fs/" + csUriStem)
)
| extend SuspiciousPath = csUriStem, ClientIP = cIP, RequestMethod = csMethod
| project TimeGenerated, SuspiciousPath, ClientIP, RequestMethod, csHost, scStatus, csUserAgent
| order by TimeGenerated desc

index=web OR index=proxy OR index=iis sourcetype IN ("iis", "access_combined", "nginx:plus:kv", "apache:access")
| where like(uri_path, "%/@fs/%") OR like(uri_path, "%/__vite%")
| eval suspicious=if(
    match(uri_path, "/@fs/.*(\.\.|\.env|/etc/|/proc/|passwd|shadow|id_rsa)") OR
    match(uri_path, "/@fs/[A-Za-z]:[/\\\\]") OR
    match(uri_path, "%2e%2e"),
    "true", "false")
| where suspicious="true"
| stats count AS request_count, values(uri_path) AS paths, values(src_ip) AS source_ips, dc(src_ip) AS unique_ips, earliest(_time) AS first_seen, latest(_time) AS last_seen BY host, dest_ip
| where request_count > 0
| eval severity=if(request_count > 10, "high", "medium")
| table host, dest_ip, source_ips, unique_ips, request_count, paths, first_seen, last_seen, severity
| sort - request_count

sequence by source.ip with maxspan=5m
  [network where event.category == "network" and
   url.path : ("*/@fs/*", "*/__vite_ping*", "*/__vite_hmr*") and
   (
     url.path : ("*../*", "*%2e%2e*", "*/.env*", "*/etc/passwd*", "*/etc/shadow*", "*/proc/self/*") or
     url.path : ("*/@fs/[A-Z]:*", "*/@fs//etc*", "*/@fs//home*", "*/@fs//root*")
   )
  ]
  [network where event.category == "network" and
   http.response.status_code == 200 and
   url.path : ("*/@fs/*")
  ]

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  destinationip,
  destinationport,
  URL,
  username,
  'CVE-2025-31125' AS cve_id,
  CATEGORYDESCRIPTION(category) AS event_category
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Apache HTTP Server', 'Microsoft IIS', 'NGINX') AND
  (
    URL IMATCHES '.*/@fs/.*(\.\.|%2e%2e|\.env|/etc/|/proc/|passwd|shadow).*' OR
    URL IMATCHES '.*/@fs/[A-Za-z]:.*' OR
    URL IMATCHES '.*/\x40fs/.*'
  ) AND
  starttime > NOW() - 7 DAYS
ORDER BY starttime DESC
LIMIT 1000

_sourceCategory=web* OR _sourceCategory=proxy* OR _sourceCategory=nginx* OR _sourceCategory=apache*
| where (%"cs-uri-stem" matches "*/@fs/*" or _raw matches "/@fs/")
| parse regex field=_raw "(?<uri_path>/@fs/[^\s\"']+)" nodrop
| parse regex field=_raw "\s(?<status_code>\d{3})\s" nodrop
| where uri_path matches "*../*" or uri_path matches "*%2e%2e*" or uri_path matches "*/.env*" or uri_path matches "*/etc/*" or uri_path matches "*/proc/*" or uri_path matches "*[A-Z]:/*"
| count by _sourceHost, src_ip, uri_path, status_code
| where status_code = "200" or _count > 5
| order by _count desc

rule cve_2025_31125_vite_path_traversal {
  meta:
    author = "df00tech"
    description = "Detects CVE-2025-31125 Vite improper access control exploitation via /@fs/ path traversal"
    severity = "HIGH"
    priority = "HIGH"
    cve = "CVE-2025-31125"
    mitre_attack = "T1190, T1083"

  events:
    $req.metadata.event_type = "NETWORK_HTTP"
    (
      re.regex($req.network.http.request_url, `.*/@fs/.*(\.\.|\.env|/etc/|/proc/|passwd|shadow).*`) or
      re.regex($req.network.http.request_url, `.*/@fs/[A-Za-z]:.*`) or
      re.regex($req.network.http.request_url, `.*/@fs//(?:etc|home|root|proc|var).*`)
    )

  condition:
    $req
}

#event_simpleName=NetworkConnectIP4 OR #event_simpleName=HttpRequest
| CommandLine = /vite|node.*server/i OR RemotePort IN (5173, 3000, 4173, 5174, 8080)
| HttpRequestUri = /\/@fs\/.*(\.\.|\.env|\/etc\/|\/proc\/|passwd|shadow)/i
   OR HttpRequestUri = /\/@fs\/[A-Za-z]:/i
   OR HttpRequestUri = /\/@fs\/\/(etc|home|root|proc|var)/i
| groupby([aid, ComputerName, RemoteAddressIP4, HttpRequestUri], function=count(1), alias=request_count)
| sort(request_count, order=desc)
| limit 1000