Cybersecurity researchers have disclosed details of a mass-scanning campaign that has targeted Vite deployments siphon sensitive data.
The first is an automated effort aimed at internet-exposed Vite development servers that’s designed to steal cloud credentials, configurations from Amazon Web Services (AWS) and Microsoft Azure instances, and infrastructure state files, per F5 Labs.
The credential harvesting activity, observed in August 2026, has been found to leverage an exploit for CVE-2026-39364 (CVSS score: 8.2), a high-severity security flaw in Vite that could permit an unauthenticated attacker to bypass security restrictions via query parameter manipulation and leak sensitive data, including files specified by server.fs.deny.
“On the Vite dev server, files that should be blocked by server.fs.deny (e.g., .env, *.crt) can be retrieved with HTTP 200 responses when query parameters such as ?raw, ?import&raw, or ?import&url&inline are appended,” Vite said in an advisory for the flaw in April 2026.
Successful exploitation, however, requires three conditions to be met for an app to be deemed affected –
- Explicitly exposes the Vite dev server to the network using –host or server.host config option
- The sensitive file exists in the allowed directories specified by server.fs.allow
- The sensitive file is denied with a pattern that matches a file by server.fs.deny
“Under default configurations, Vite binds to localhost,” F5 Labs said. “When developers expose the service by passing the –host flag, setting server.host, or misconfiguring Docker container port mappings, the development server becomes directly reachable over the local network or public internet.”
Attackers can issue an HTTP GET request to the /@fs/ endpoint, referencing a sensitive file path and appending bypass query parameters. This causes the server to process the request, while undermining the server.fs.deny check, and ultimately return the contents of the requested file in plaintext in the HTTP response body.
This can have severe implications when the request is used to target configuration directories, granting the attackers unauthorized access to plaintext API secrets, database passwords, and cloud administrative credentials. F5 said it observed several requests consistent with the flaw to conduct reconnaissance and extract the following types of data –
- Environment configurations
- AWS credentials
- AWS configurations and backups
- Infrastructure state files (e.g., terraform.tfstate and serverless.yml)
- Azure profiles
- System memory and environment details (e.g., /etc/passwd, /proc/self/environ, /proc/1/environ, and /proc/self/cwd/.env)
“Probing /proc/self/cwd/.env demonstrates an understanding of the deployment stack, reading the active .env file relative to the running process without needing to guess the absolute web application path,” F5 said.
The requests make use of bogus User-Agent headers impersonating major web crawlers and artificial intelligence bots, like Googlebot, ClaudeBot, GPTBot, PerplexityBot, OAI-SearchBot, and Amazonbot. The requests also inject forged X-Forwarded-For and X-Real-IP values (e.g., 34.94.237[.]62 and 104.28.219[.]193) to get around IP-based access lists and complicate log analysis.
A significant chunk of the malicious activity has originated from the U.S., Belgium, the Netherlands, Singapore, and Taiwan, with the attackers using Google Cloud Platform ranges (34.x and 35.x) to fly under the radar.
