Skip to content

Opening a malicious website while running a Nuxt dev server could allow read-only access to code

Moderate
danielroe published GHSA-2452-6xj8-jh47 Jan 24, 2025

Package

npm @nuxt/vite-builder (npm)

Affected versions

>=3.8.1<3.15.3

Patched versions

>=3.15.3

Description

Summary

Nuxt allows any websites to send any requests to the development server and read the response due to default CORS settings.

Details

While Vite patched the default CORS settings to fix GHSA-vg6x-rcgg-rjx6, nuxt uses its own CORS handler by default (#23995).

nuxt/packages/vite/src/client.ts

Lines 257 to 263 in 7d345c7

} else if (!useViteCors) {
if (event.method === 'OPTIONS') {
appendCorsPreflightHeaders(event, {})
return null
}
appendCorsHeaders(event, {})
}

That CORS handler sets Access-Control-Allow-Origin: *.

Important

If on an affected version, it may be possible to opt-out of the default Nuxt CORS handler by configuring vite.server.cors.

PoC

  1. Start a dev server in any nuxt project using Vite by nuxt dev.
  2. Send a fetch request to http://localhost:3000/_nuxt/app.vue (fetch('http://localhost:3000/_nuxt/app.vue')) from a different origin page.

Impact

Users with the default server.cors option using Vite builder may get the source code stolen by malicious websites

Additional Information

/__nuxt_vite_node__/manifest / /__nuxt_vite_node__/module also seems to have Access-Control-Allow-Origin: *, so it maybe also possible to exploit that handler.

nuxt/packages/vite/src/vite-node.ts

Line 39 in 7d345c7

server.middlewares.use('/__nuxt_vite_node__', toNodeListener(createViteNodeApp(ctx, invalidates)))

Although I didn't find a valid module id.
Note that this handler is probably also vulnerable to DNS rebinding attacks as I didn't find any host header checks.

Severity

Moderate

CVSS overall score

This score calculates overall vulnerability severity from 0 to 10 and is based on the Common Vulnerability Scoring System (CVSS).
/ 10

CVSS v3 base metrics

Attack vector
Network
Attack complexity
High
Privileges required
None
User interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

CVSS v3 base metrics

Attack vector: More severe the more the remote (logically and physically) an attacker can be in order to exploit the vulnerability.
Attack complexity: More severe for the least complex attacks.
Privileges required: More severe if no privileges are required.
User interaction: More severe when no user interaction is required.
Scope: More severe when a scope change occurs, e.g. one vulnerable component impacts resources in components beyond its security scope.
Confidentiality: More severe when loss of data confidentiality is highest, measuring the level of data access available to an unauthorized user.
Integrity: More severe when loss of data integrity is the highest, measuring the consequence of data modification possible by an unauthorized user.
Availability: More severe when the loss of impacted component availability is highest.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

CVE ID

CVE-2025-24360

Weaknesses

Credits