Mass-Scanning Campaign Exploits Vite Flaw to Extract Cloud Credentials From Exposed Dev Servers
Mass-scanning campaign exploits CVE-2026-39364 in exposed Vite dev servers to steal AWS/Azure credentials, .env files, and Terraform state.
F5 Labs documented an August 2026 credential-harvesting campaign exploiting CVE-2026-39364 (CVSS 8.2), a Vite flaw allowing unauthenticated attackers to bypass server.fs.deny via query parameters like ?raw and ?import&raw. Attackers issue GET requests to /@fs/ endpoints to retrieve .env files, AWS and Azure credentials, terraform.tfstate, serverless.yml, and /proc data from dev servers exposed via --host or misconfigured Docker port mappings. Requests impersonate crawlers like Googlebot, ClaudeBot, and GPTBot, forge X-Forwarded-For headers, and largely originate from GCP ranges in the US, Belgium, Netherlands, Singapore, and Taiwan.
- CVE-2026-39364 bypasses server.fs.deny via ?raw and ?import&raw query parameters
- Exploitation requires the dev server exposed via --host, server.host, or Docker misconfiguration
- Harvested data includes AWS/Azure credentials, terraform.tfstate, and /proc/self/environ
- Fake User-Agents include Googlebot, ClaudeBot, GPTBot, PerplexityBot, and Amazonbot
- Much of the scanning activity originates from Google Cloud Platform IP ranges
- CVEs
- CVE-2026-39364
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1552.001 Credentials In FilesT1595.002 Vulnerability Scanning
- Products
- Vite dev serverAWSAzureTerraform
- Organizations
- F5 Labs
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-39364 | Vite: On the Vite dev server, files that should be blocked by server.fs.deny (e.g., .env, *.crt) can be retrieved with HTTP 200… | 8.2 | 2% | PoC |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | server.host | exposes the Vite dev server to the network using --host or server.host config option The sensitive file exists in the allowed dire |
| ipv4 | 104.28.219.193 | orwarded-For and X-Real-IP values (e.g., 34.94.237[.]62 and 104.28.219[.]193) to get around IP-based access lists and complicate log a |
| ipv4 | 34.94.237.62 | o inject forged X-Forwarded-For and X-Real-IP values (e.g., 34.94.237[.]62 and 104.28.219[.]193) to get around IP-based access lists |
From the original article
2 min read at thehackernews.com
Cybersecurity researchers have disclosed details of a mass-scanning campaign that has targeted Vite deployments siphon sensitive data. The first is an automated effort aimed at internet-exposed Vite development servers that's designed to steal cloud credentials, configurations from Amazon Web Services (AWS) and Microsoft Azure instances, and infrastructure state files, per F5 Labs. The
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.