CVE-2024-23331General(microsoft / vite)

MEDIUMCVSS 7.5 · HIGH

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

  • Prioritize remediation for microsoft vite systems immediately
  • Assume compromise if assets are exposed
  • Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

Vite is a frontend tooling framework for javascript. The Vite dev server option `server.fs.deny` can be bypassed on case-insensitive file systems using case-augmented versions of filenames. Notably this affects servers hosted on Windows. This bypass is similar to CVE-2023-34092 -- with surface area reduced to hosts having case-insensitive filesystems. Since `picomatch` defaults to case-sensitive glob matching, but the file server doesn't discriminate; a blacklist bypass is possible. By requesting raw filesystem paths using augmented casing, the matcher derived from `config.server.fs.deny` fails to block access to sensitive files. This issue has been addressed in [email protected], [email protected], [email protected], and [email protected]. Users are advised to upgrade. Users unable to upgrade should restrict access to dev servers.

4.0/ 10 priority

Sources & remediation

Weakness type (CWE)
CWE-178CWE-200CWE-284

Priority

MEDIUM

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • vite
  • windows

Threat summary

  • Active exploitation appears in 1 classified signals
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Active exploitation reported across 1 signal
  • General: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-06-15); latest day: 1
  • 2 total mentions across 2 days

Affected systems

Products
vitewindows

1 version affected across 2 products

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-06-15: 1Mentions · 2026-09-15: 1Active Exploitation · 2026-09-15: 106-1509-15
Signal classification2 categories
General
150.0%
Active Exploitation
150.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-06-151
General1
2026-09-151
Active Exploitation1
Full discourse2 posts
  • Aviatrix Threat Research Center@aviatrixtrc
    Active Exploitation

    TRC analysis shows attackers conducted mass scanning to identify exposed Vite development servers, then exploited CVE-2024-23331 to steal AWS and Azure credentials. The campaign demonstrates how compromised dev environments enable lateral movement across cloud regions. Runtime segmentation helps contain such post-compromise activity. #CloudSecurity 🔗 Full TRC analysis: https://aviatrix.ai/threat-research-center/mass-scanning-vite-flaw-cloud-credentials-2024

    Post summary

    The text reports that attackers actively exploited CVE-2024-23331 through mass scanning of exposed Vite development servers to steal cloud credentials in a real-world campaign, confirming active in-the-wild exploitation.

    0000048
    2.0K followersView on X
  • DailyCVE@dailycve
    General

    🟠 Angular HttpTransferCache Hash Collision Vulnerability, #CVE-2024-23331 (Medium) -DC-Jun2026-423 https://dailycve.com/angular-httptransfercache-hash-collision-vulnerability-cve-2024-23331-medium-dc-jun2026-423/

    Post summary

    The post merely references a CVE with a link to an external article, without offering any details on exploitation, mitigation, or verification.

    0000033
    212 followersView on X
CPE platform detail2 entries

2 of 2 entries

PartVendorProductVersionTarget SWTarget HW
OSmicrosoftwindows---
Appvitejsvite-node.js-

Explore more