Hackers target exposed Vite dev servers to steal AWS, Azure secrets
Mass scanning campaign exploits CVE-2026-39364 in exposed Vite dev servers to steal AWS, Azure, and Terraform credentials.
F5 honeypots detected over 800 attacks and roughly 32,000 events in a month against internet-exposed Vite development servers, abusing CVE-2026-39364 (file access control bypass in Vite 7.1.0-7.3.2 and 8.x before 8.0.5) via parameters like ?raw and ?import&raw. Attackers used extensive wordlists to harvest .env files, AWS/Azure credentials, Terraform state, and /proc/self/environ, with double-encoded traversal to bypass WAFs. The same IPs also leveraged older Vite flaws CVE-2025-30208, actively-exploited CVE-2025-31125, and CVE-2024-45811, primarily from US, Belgium, and Netherlands using Google Cloud ranges.
- CVE-2026-39364 allows unauthenticated file read bypass in Vite 7.1.0-7.3.2 and 8.x before 8.0.5
- F5 observed 800+ attacks and ~32,000 events over one month
- Attackers targeted .env files, AWS/Azure credentials, Terraform state via wordlists
- Double-encoded traversal used to evade reverse proxies and WAFs
- Patch Vite, block port 5173, and rotate all exposed secrets
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-45811 | Vite a frontend build tooling framework for javascript. Vite a frontend build tooling framework for javascript. In affected versions the contents of arbitrary files can be returned to the browser. `@fs` denies access to files outside of Vite serving allow list. Adding `?import&raw` to the URL bypasses this limitation and returns the file content if it exists. This issue has been patched in versions 5.4.6, 5.3.6, 5.2.14, 4.5.5, and 3.2.11. Users are advised to upgrade. There are no known workarounds for this vulnerability. NVD description · AI analysis pending | 4.8 | 1% | — | — | ||
| CVE-2025-30208 | Unauthenticated Arbitrary File Read in Vite Dev Server via @fs Allow-List Bypass Vite dev servers in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10 fail to enforce the `@fs` file-access allow list because trailing separators such as `?` are stripped in several places but are not accounted for in the query-string regexes. A remote, unauthenticated attacker triggers the flaw by appending `?raw??` or `?import&raw??` to a dev-server URL, bypassing the restriction and returning the contents of arbitrary files on the host if they exist. The impact is confidentiality only — arbitrary file read with no code execution or privilege escalation, consistent with the CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Only projects that explicitly expose the Vite dev server to the network (via `--host` or the `server.host` config option) are affected; purely local development usage is not remotely exploitable. A public proof of concept is available in the GitHub advisory (GHSA-x574-m823-4x7w); the flaw is not yet in CISA KEV, but EPSS assigns a 75% probability of exploitation within 30 days (99th percentile), so opportunistic scanning is likely. Do: Upgrade Vite to 6.2.3, 6.1.2, 6.0.12, 5.4.15, or 4.5.10 depending on your release branch. If you cannot upgrade immediately, stop exposing the dev server to untrusted networks (remove `--host` / set `server.host` to localhost) or firewall the dev-server port. Audit internet-facing hosts for running Vite dev servers and check access logs for requests containing `?raw??` or `?import&raw??`, which may indicate exploitation attempts. | 7.5 | 75% | PoC |
| massmillions of installs run affected Vite versions (millions of weekly npm downloads); the remotely exploitable subset | |
| CVE-2025-31125 | Vite Dev Server Improper Access Control Exposes Protected Files (Actively Exploited) CVE-2025-31125 is an improper access control flaw (CWE-284/CWE-200) in the Vite JavaScript frontend tooling's dev server, where HTTP requests using the '?inline&import' or '?raw?import' query parameters can read the contents of files the dev server should not serve, bypassing its file-access restrictions (server.fs.deny). An unauthenticated remote attacker (CVSS:3.1 AV:N/AC:L/PR:N/UI:N) triggers it by sending crafted requests with these query parameters to a running Vite dev server. The attacker gains read access to arbitrary files on the machine running the dev server, such as source code and .env files containing secrets, with high confidentiality impact and no integrity or availability impact. Only applications that explicitly expose the Vite dev server to the network via the --host flag or the server.host option are affected; production builds are not impacted. The flaw is being actively exploited: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-01-22 (ransomware association unknown), and EPSS assigns a 58.5% probability of exploitation within 30 days (99th percentile). Do: Upgrade Vite to 6.2.4, 6.1.3, 6.0.13, 5.4.16, or 4.5.11 depending on your release line. Until patched, do not expose the dev server to untrusted networks (remove --host/server.host or bind to localhost behind an access-controlled proxy), and review access logs for requests using ?inline&import or ?raw?import that retrieved sensitive files such as .env. As a KEV entry added 2026-01-22, U.S. federal agencies must apply vendor mitigations per BOD 22-01 or discontinue use if mitigations are unavailable. | 7.5 | 58% | KEV PoC |
| largeplausibly tens of thousands to ~100,000 network-exposed Vite dev servers, out of millions of total Vite users | |
| CVE-2026-39364 | Vite is a frontend tooling framework for JavaScript. Vite is a frontend tooling framework for JavaScript. From 7.1.0 to before 7.3.2 and 8.0.5, on the Vite dev server, files that should be blocked by server.fs.deny (e.g., .env, *.crt) can be retrieved with HTTP 200 responses when query parameters such as ?raw, ?import&raw, or ?import&url&inline are appended. This vulnerability is fixed in 7.3.2 and 8.0.5. NVD description · AI analysis pending | 8.2 | 2% | PoC |
| — |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| domain | server.host | pose it online through passing the --host flag, setting the server.host, or misconfigured Docker port mappings. The technology comp |
Full article428 words · extracted from bleepingcomputer.com · click to collapse
A mass-scanning campaign targeting internet-exposed Vite development servers is attempting to steal cloud credentials and configurations from AWS and Azure deployments.
The operation leverages an exploit for CVE-2026-39364, a high-severity vulnerability that allows bypassing file read/access controls in Vite versions 7.1.0 through 7.3.2, as well as the 8.x branch before 8.0.5.
The flaw was disclosed on April 7 and allows an unauthenticated attacker to manipulate query parameters in an HTTP GET request to bypass security restrictions and retrieve files in plaintext from locations that should normally be out of their reach.
Technology company F5 detected the attacks through its honeypot sensors, observing more than 800 attacks and approximately 32,000 raw events over a month.
“When specific parameters such as ?raw, ?import&raw, or ?import&url&inline are appended to a request, the server fails to enforce deny-list filtering and serves the target file with an HTTP 200 response,” F5 explains.
After breaching a system, the scanning focused on valuable secrets by using extensive wordlists for the following types of data:
- .env, .env.production, .env.local, and other environment files
- AWS credential files from several possible home directories
- AWS configuration files and credential backups
- Azure credentials and access tokens
- Terraform state and variable files
- Serverless configuration/state
- /proc/self/environ, /proc/1/environ, and /proc/self/cwd/.env
- /etc/passwd
F5 notes that the operation also tried traversal and encoding variants, including double-encoded traversal sequences, apparently to get past reverse proxies or WAF normalization.
Most of the observed malicious activity originated from the United States, Belgium, and the Netherlands, with the attackers using Google Cloud IP ranges for evasion.
The most active IP addresses also leveraged other access control flaws in Vite: CVE-2025-30208, CVE-2025-31125 (flagged as actively exploited), and CVE-2024-45811.
How to protect Vite
Although Vite normally binds to localhost, F5 researchers say that developers often expose it online through passing the --host flag, setting the server.host, or misconfigured Docker port mappings.
The technology company recommends updating Vite servers to the latest version, which addresses the exploited flaws. Developers should also block access through port 5173, block suspicious /@fs/ requests, and avoid trusting crawler User-Agent strings.
The top sources for the malicious attempts are 34.14.15[.]105, 34.16.200[.]129, and 34.11.196[.]206, which should be blocklisted.
If unpatched Vite servers were publicly exposed, it is recommended to rotate all secrets in the reach of the vulnerable system.
Build your security blueprint for AI-powered attacks
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.bleepingcomputer.com/news/security/hackers-target-exposed-vite-dev-servers-to-steal-aws-azure-secrets/