Mass Scan Campaign Exploits Vite Flaw to Steal AWS Credentials — SkimNews
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- F5 Labs disclosed a mass-scanning campaign observed in August 2026 that targets internet-exposed Vite development servers to harvest AWS and Azure cloud credentials, configurations, and infrastructure state files.
- Attackers exploit CVE-2026-39364, a high-severity Vite flaw (CVSS 8.2) disclosed in April 2026 that lets unauthenticated requests bypass the server.fs.deny restriction via query parameters such as ?raw, ?import&raw, or ?import&url&inline, returning sensitive files with HTTP 200 responses.
- Successful exploitation requires three specific conditions: the dev server must be explicitly exposed via --host or server.host, the targeted file must sit within a server.fs.allow directory, and it must match a server.fs.deny pattern.
- Targeted payloads include environment configurations, AWS credentials and backups, terraform.tfstate and serverless.yml files, Azure profiles, and system files like /etc/passwd, /proc/self/environ, and /proc/self/cwd/.env.
- The attackers impersonate crawlers including Googlebot, ClaudeBot, GPTBot, PerplexityBot, OAI-SearchBot, and Amazonbot, while injecting forged X-Forwarded-For and X-Real-IP values to slip past IP-based access lists.
- Malicious traffic originated significantly from the U.S., Belgium, the Netherlands, Singapore, and Taiwan, with attackers routing requests through Google Cloud Platform's 34.x and 35.x IP ranges.
Why it matters: Vite binds to localhost by default, but developers routinely expose the dev server via --host flags or misconfigured Docker port mappings — turning any reachable instance into a plaintext channel for API secrets, database passwords, and cloud administrative credentials that grant attackers a direct path into production AWS and Azure environments.
Ask SkimNews
