Hackers Mass-Scan Exposed Vite Servers to Steal AWS and Azure Cloud Credentials
F5 honeypots record mass scanning of exposed Vite dev servers exploiting CVE-2026-39364 to harvest AWS and Azure cloud credentials.
F5 honeypots recorded 807 session-grouped attacks and roughly 32,000 raw events in August 2026 against internet-exposed Vite development servers, up from 1,732 events in the previous three months. Scanners abused CVE-2026-39364 (Vite 7.1.0-7.3.1, 8.0.0-8.0.4), bypassing server.fs.deny via @fs routes with ?raw/?import query parameters and double encoding to read .env files, AWS SSO caches, Azure tokens, and Terraform state. The same infrastructure also probed CVE-2025-29927 (Next.js), CVE-2025-30208, CVE-2025-31125 (KEV-listed January 2026), and CVE-2024-45811. Most traffic originated from Google Cloud IP ranges, with the US accounting for 17,297 events.
- ~32,000 honeypot events in August 2026 versus 1,732 over prior three months
- Query-string bypasses of server.fs.deny expose .env, AWS, Azure, and Terraform secrets
- Scanners rotate forged User-Agents (Googlebot, GPTBot) and spoofed X-Forwarded-For headers
- Upgrade to Vite 7.3.2/8.0.5+ and rotate all secrets on previously exposed servers
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-45811 | Vite a frontend build tooling framework for javascript | 4.8 | 1% | ||
| CVE-2025-29927 | Middleware Authorization Bypass in Vercel Next.js (CVE-2025-29927) | 9.1 | 99% | PoC ×4 | |
| CVE-2025-30208 | Unauthenticated Arbitrary File Read in Vite Dev Server via @fs Allow-List Bypass | 7.5 | 75% | PoC | |
| CVE-2025-31125 | Vite Dev Server Improper Access Control Exposes Protected Files (Actively Exploited) | 7.5 | 75% | KEVPoC ×2 | KEV |
| CVE-2026-39364 | Vite: On the Vite dev server, files that should be blocked by server.fs.deny (e.g., .env, *.crt) can be retrieved with HTTP 200… | 8.2 | 2% | PoC |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | f5.com | allowlists. Vulnerability scan distribution (Image Source: f5.com) Most activity originated from cloud-hosting infrastructure |
| domain | server.host | se it to LAN or public interfaces through the –host option, server.host configuration, container port mappings, Kubernetes ingress |
From the original article
3 min read at cybersecuritynews.com
Hackers are conducting a large-scale automated scanning campaign against internet-exposed Vite development servers, attempting to steal AWS credentials, Azure access tokens, environment variables, and Infrastructure-as-Code secrets.
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.