A Mass-Scanning Campaign Targets Exposed Vite Dev Servers, Stealing Cloud Credentials and Configurations
Cybersecurity researchers have detected a widespread campaign targeting internet-exposed Vite development servers, with hackers attempting to steal sensitive cloud credentials and configurations from AWS and Azure deployments. The operation leverages an exploit for CVE-2026-39364, a high-severity vulnerability in Vite versions 7.1.0 through 7.3.2, as well as the 8.x branch before 8.0.5.
The flaw allows an unauthenticated attacker to manipulate query parameters in an HTTP GET request, bypassing security restrictions and retrieving files in plaintext from locations that should normally be off-limits. This vulnerability was disclosed on April 7, but it seems that hackers have been actively exploiting it since then. The attackers are using extensive wordlists to search for valuable secrets, including environment files, AWS credential files, Azure credentials, and Terraform state and variable files.
The scanning campaign has been detected by F5’s honeypot sensors, which observed over 800 attacks and approximately 32,000 raw events over a month. The attackers are using Google Cloud IP ranges to evade detection, and most of the malicious activity originated from the United States, Belgium, and the Netherlands. The operation also tried traversal and encoding variants, including double-encoded traversal sequences, to get past reverse proxies or WAF normalization.
What’s particularly concerning about this campaign is that it’s not just a simple exploit – hackers are using multiple vulnerabilities in Vite to gain access to sensitive data. F5 researchers have noted that the attackers are leveraging other access control flaws in Vite, including CVE-2025-30208 and CVE-2024-45811.
So, what can developers do to protect their Vite servers? First and foremost, it’s essential to update Vite to the latest version, which addresses the exploited flaws. Additionally, developers should block access through port 5173, as well as suspicious /@fs/ requests. It’s also crucial to avoid trusting crawler User-Agent strings.
If your organization has exposed Vite servers that haven’t been patched yet, it’s recommended to rotate all secrets in reach of the vulnerable system. This is a critical step in preventing unauthorized access and minimizing potential damage. By taking these precautions, developers can significantly reduce the risk of their systems being compromised by this mass-scanning campaign.
In conclusion, this campaign serves as a reminder that even seemingly minor vulnerabilities can be exploited on a massive scale if left unpatched. Developers must stay vigilant and prioritize patching and securing their Vite servers to prevent sensitive data from falling into the wrong hands. By doing so, they can ensure the security and integrity of their cloud deployments.
Source: Bleeping Computer — 2026-09-14