Hackers target exposed Vite dev servers to steal AWS, Azure secrets
Mass scanning campaign exploits CVE-2026-39364 in exposed Vite dev servers to steal AWS, Azure, and Terraform credentials.
F5 honeypots detected over 800 attacks and roughly 32,000 events in a month against internet-exposed Vite development servers, abusing CVE-2026-39364 (file access control bypass in Vite 7.1.0-7.3.2 and 8.x before 8.0.5) via parameters like ?raw and ?import&raw. Attackers used extensive wordlists to harvest .env files, AWS/Azure credentials, Terraform state, and /proc/self/environ, with double-encoded traversal to bypass WAFs. The same IPs also leveraged older Vite flaws CVE-2025-30208, actively-exploited CVE-2025-31125, and CVE-2024-45811, primarily from US, Belgium, and Netherlands using Google Cloud ranges.
- CVE-2026-39364 allows unauthenticated file read bypass in Vite 7.1.0-7.3.2 and 8.x before 8.0.5
- F5 observed 800+ attacks and ~32,000 events over one month
- Attackers targeted .env files, AWS/Azure credentials, Terraform state via wordlists
- Double-encoded traversal used to evade reverse proxies and WAFs
- Patch Vite, block port 5173, and rotate all exposed secrets
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-45811 | Vite a frontend build tooling framework for javascript | 4.8 | 1% | ||
| CVE-2025-30208 | Unauthenticated Arbitrary File Read in Vite Dev Server via @fs Allow-List Bypass | 7.5 | 75% | PoC | |
| CVE-2025-31125 | Vite Dev Server Improper Access Control Exposes Protected Files (Actively Exploited) | 7.5 | 75% | KEVPoC ×2 | KEV |
| CVE-2026-39364 | Vite: On the Vite dev server, files that should be blocked by server.fs.deny (e.g., .env, *.crt) can be retrieved with HTTP 200… | 8.2 | 2% | PoC |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | server.host | pose it online through passing the --host flag, setting the server.host, or misconfigured Docker port mappings. The technology comp |
| ipv4 | 34.11.196.206 | malicious attempts are 34.14.15[.]105, 34.16.200[.]129, and 34.11.196[.]206, which should be blocklisted. If unpatched Vite servers w |
| ipv4 | 34.14.15.105 | ent strings. The top sources for the malicious attempts are 34.14.15[.]105, 34.16.200[.]129, and 34.11.196[.]206, which should be bl |
| ipv4 | 34.16.200.129 | top sources for the malicious attempts are 34.14.15[.]105, 34.16.200[.]129, and 34.11.196[.]206, which should be blocklisted. If unp |
From the original article
2 min read at bleepingcomputer.com
A mass-scanning campaign targeting internet-exposed Vite development servers is attempting to steal cloud credentials and configurations from AWS and Azure deployments. [...]
By Bill Toulas · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.