Cybersecurity researchers have uncovered a mass scanning campaign targeting exposed Vite development servers to extract sensitive information, including cloud credentials, infrastructure files, and system data. According to findings from F5 Labs, attackers have been exploiting CVE-2026-39364, a high severity vulnerability in Vite with a CVSS score of 8.2, to bypass security restrictions and access files that should normally remain protected. The activity, observed in August 2026, focused on internet accessible Vite development environments and attempted to collect valuable configuration data from Amazon Web Services (AWS) and Microsoft Azure deployments.
The vulnerability affects Vite development servers when specific conditions are present. Researchers explained that attackers can exploit the flaw through query parameter manipulation, allowing them to retrieve sensitive files that are restricted through the server.fs.deny security setting. Vite previously disclosed that files such as environment configuration files and certificate files could potentially be accessed through HTTP requests when certain query parameters, including ?raw, ?import&raw, or ?import&url&inline, are added. Successful exploitation depends on multiple factors, including the Vite development server being intentionally exposed to a network through options such as the –host flag or server.host configuration, the sensitive file existing within directories allowed by server.fs.allow, and the file being restricted by a matching server.fs.deny pattern.
F5 Labs stated that Vite normally binds to localhost under default configurations, which limits external access. However, when developers expose the service through network settings, container configurations, or incorrect deployment practices, the development environment can become accessible through local networks or the public internet. Attackers were observed sending HTTP GET requests to the /@fs/ endpoint while referencing sensitive file paths and adding bypass parameters. This process allowed them to avoid normal restrictions and retrieve file contents in plaintext responses. The exposed information included environment configurations, AWS credentials, AWS configuration files and backups, infrastructure state files such as terraform.tfstate and serverless.yml, Azure profiles, and system information including files linked to running processes and environment details.
Researchers highlighted that accessing these files can create significant security concerns because exposed configuration data may contain API secrets, database passwords, and cloud administration credentials. F5 Labs observed requests targeting files such as /proc/self/environ, /proc/1/environ, and /proc/self/cwd/.env, indicating that attackers were attempting to understand the deployment environment and collect information directly from active application processes. The ability to retrieve the current .env file from the running application directory allowed attackers to access configuration details without needing to identify the complete application path manually.
The campaign also involved techniques designed to make detection more difficult. Attackers used fake User-Agent headers that imitated major web crawlers and artificial intelligence bots, including Googlebot, ClaudeBot, GPTBot, PerplexityBot, OAI-SearchBot, and Amazonbot. They also inserted forged X-Forwarded-For and X-Real-IP headers using different IP addresses to bypass IP based access controls and complicate security log analysis. A significant amount of malicious activity originated from locations including the United States, Belgium, the Netherlands, Singapore, and Taiwan, while attackers used Google Cloud Platform IP ranges, including 34.x and 35.x addresses, to reduce visibility and blend with legitimate cloud traffic. The findings highlight the importance of securing development environments, limiting public exposure of internal tools, applying security updates, and reviewing cloud access credentials regularly to reduce risks associated with vulnerable deployments.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
