Mass-Scanning Campaign Exploits Vite Flaw to Extract Cloud Credentials From Exposed Dev Servers
A mass-scanning campaign is exploiting a vulnerability in Vite to steal sensitive cloud credentials and infrastructure data from exposed development servers. The campaign leverages a high-severity flaw (CVE-2026-39364) allowing unauthenticated attackers to bypass security restrictions and extract files like .env and AWS configurations. Attackers are originating from multiple countries, including the U.S., Belgium, and Singapore, using Google Cloud Platform ranges to mask their activity.
Cybersecurity researchers have disclosed details of a mass-scanning campaign targeting Vite deployments to siphon sensitive data. The campaign is exploiting a high-severity security flaw (CVE-2026-39364) in Vite, a JavaScript framework, to steal cloud credentials and infrastructure data from internet-exposed development servers. The vulnerability allows unauthenticated attackers to bypass security restrictions via query parameter manipulation and leak sensitive files, including .env and AWS configurations.
Successful exploitation requires three conditions to be met: the Vite dev server must be explicitly exposed to the network using `--host` or `server.host` config, the sensitive file must exist in allowed directories specified by `server.fs.allow`, and the sensitive file must be denied with a pattern that matches a file by `server.fs.deny`.
Attackers are using HTTP GET requests to the `/@fs/` endpoint, referencing a sensitive file path and appending bypass query parameters to undermine the `server.fs.deny` check and return the contents of the requested file in plaintext. This can lead to unauthorized access to API secrets, database passwords, and cloud administrative credentials.
Researchers observed numerous requests consistent with the flaw, targeting environment configurations, AWS credentials, AWS configurations and backups, infrastructure state files (e.g., terraform.tfstate and serverless.yml), Azure profiles, and system memory/environment details. The requests utilize bogus User-Agent headers mimicking web crawlers and AI bots (Googlebot, ClaudeBot, GPTBot, PerplexityBot, OAI-SearchBot, and Amazonbot) and inject forged X-Forwarded-For and X-Real-IP values to evade IP-based access controls and complicate log analysis.
The campaign’s activity has been primarily originating from the U.S., Belgium, the Netherlands, Singapore, and Taiwan, utilizing Google Cloud Platform ranges (34.x and 35.x) to obscure their location.