Hackers Mass-Scan Exposed Vite Servers to Steal AWS Credentials and Terraform Secrets

Threat actors are mass-scanning internet-exposed Vite development servers to steal cloud credentials, environment files, and Infrastructure-as-Code secrets.

F5 Labs honeynet telemetry recorded 807 session-grouped attacks and roughly 32,000 raw events during August 2026, marking a sharp rise from only 1,732 Vite-related events observed across the prior three months.

The campaign exploits CVE-2026-39364, a high-severity unauthenticated file-read vulnerability in Vite’s development server. Rated CVSS 7.5, the flaw affects Vite versions 7.1.0 through versions before 7.3.2 and 8.0.5.

Attackers can bypass Vite’s server.fs.deny access controls and retrieve files that should be blocked from external access. Vite uses the internal /@fs/ route during development to serve files from the local filesystem.

Hackers Mass-Scan Exposed Vite Servers

Although the framework includes deny-list protections for sensitive files such as .env configurations, certificates, and source code, CVE-2026-39364 lets attackers bypass those controls through manipulated query parameters.

Observed exploit requests appended values including ?raw, ?import&raw, and ?import&url&inline to file paths. The server can then mishandle access validation and return restricted files with an HTTP 200 response.

Attackers also used traversal variations to evade path-normalization controls, including double-encoded slash characters. Example probes included requests for /.env, /root/.env, /proc/self/environ, and paths using %252f sequences intended to survive decoding by proxies or web application firewalls.

The activity overlaps with exploitation attempts for earlier Vite file-disclosure flaws, including CVE-2025-30208, CVE-2025-31125, and CVE-2024-45811.

This indicates that the scanning infrastructure incorporates multiple known bypass methods rather than relying on a single vulnerability. The scanner did not simply seek generic configuration files.

Its wordlists specifically targeted AWS credentials across common Linux user directories, such as /root/.aws/credentials, /home/ubuntu/.aws/credentials, /home/ec2-user/.aws/credentials, and application directories including /app/.aws/credentials.

Terraform and serverless deployment artifacts were also heavily targeted. Requests sought terraform.tfstate, terraform.tfvars, .terraform/terraform.tfstate, serverless.yml, and .serverless/serverless-state.json.

These files can expose cloud access keys, database credentials, API tokens, resource identifiers, and deployment metadata. Azure credential stores, including .azure/credentials and accessTokens.json, were also included.

The use of /proc/self/cwd/.env was particularly notable because it allows attackers to retrieve an active application environment file without knowing the application’s absolute deployment path.

Most Vite-related events were classified as information leakage, followed by predictable resource-location probing and path traversal. Requests commonly used HTTP/1.0 with Connection: close, consistent with scripted scanning tools.

F5 Labs stated that threat actors rotated forged User-Agent strings impersonating Googlebot, ClaudeBot, GPTBot, PerplexityBot, Amazonbot, and other crawlers.

They also supplied spoofed X-Forwarded-For and X-Real-IP headers, likely to complicate incident-response investigations and bypass weak IP-based allow lists.

The campaign’s sources were concentrated in cloud-hosting ranges, particularly Google Cloud infrastructure. Several IP addresses generated parallel exploit traffic for both the new Vite flaw and older Vite bypasses, while a subset also tested a Next.js middleware vulnerability.

Mitigation

Organizations should update Vite to patched releases, including 7.3.2 or 8.0.5, and ensure development servers never bind directly to public interfaces.

Teams should audit Docker port mappings, Kubernetes ingress configurations, cloud security groups, and reverse proxies for exposed development ports such as 5173.

Security teams should block /@fs/ requests at the perimeter, avoid trusting crawler User-Agent strings, and rotate AWS, Azure, API, database, and Terraform secrets if an exposed Vite server may have been reachable.

Detect 58% more threats with fresh intelligence from 16K+ organizations. Integrate TI Feeds in you SOC

The post Hackers Mass-Scan Exposed Vite Servers to Steal AWS Credentials and Terraform Secrets appeared first on Cyber Security News.