Full Report
Cybersecurity researchers have disclosed details of a mass-scanning campaign that has targeted Vite deployments siphon sensitive data. The first is an automated effort aimed at internet-exposed Vite development servers that's designed to steal cloud credentials, configurations from Amazon Web Services (AWS) and Microsoft Azure instances, and infrastructure state files, per F5 Labs. The
Analysis Summary
# Vulnerability: Mass-Scanning Campaign Exploits Vite Dev Server Security Bypass
## CVE Details
- **CVE ID:** CVE-2026-39364
- **CVSS Score:** 8.2 (High)
- **CWE:** Security Bypass / Information Exposure
## Affected Systems
- **Products:** Vite (Development Server)
- **Versions:** Vulnerable versions prior to the April 2026 patch.
- **Configurations:** The vulnerability is applicable only when all three conditions are met:
1. The Vite dev server is explicitly exposed to the network (via `--host` flag, `server.host` config, or Docker port mapping).
2. The sensitive file resides within a directory allowed by `server.fs.allow`.
3. The file is meant to be blocked by `server.fs.deny` (e.g., `.env`, `*.crt`, `.tfstate`).
## Vulnerability Description
The flaw allows an unauthenticated attacker to bypass `server.fs.deny` restrictions by manipulating query parameters. By appending specific parameters such as `?raw`, `?import&raw`, or `?import&url&inline` to a request targeting the `/@fs/` endpoint, the server fails to enforce the deny list. This results in the server returning the full contents of sensitive files in plaintext.
## Exploitation
- **Status:** Exploited in the wild (Mass-scanning campaign observed in August 2026).
- **Complexity:** Low
- **Attack Vector:** Network (Publicly exposed development servers).
## Impact
- **Confidentiality:** High (Leaking of AWS/Azure credentials, `.env` files, API secrets, and SSH keys).
- **Integrity:** None (Directly).
- **Availability:** None (Directly).
## Remediation
### Patches
- Users should update Vite to the versions released following the April 2026 advisory (refer to the official Vite GitHub security advisory for specific version numbers).
### Workarounds
- **Bind to Localhost:** Ensure the development server is not exposed to the public internet. Use default configurations where Vite binds to `localhost` (127.0.0.1).
- **Access Controls:** Use firewall rules or VPNs if network access is required, rather than exposing the port to the open web.
- **Environment Management:** Avoid storing production secrets in development environments that may be exposed.
## Detection
- **Indicators of Compromise:**
- Requests to `/@fs/` containing query parameters like `?raw` or `?import&raw`.
- Requests for sensitive paths: `/etc/passwd`, `/proc/self/environ`, `.env`, `terraform.tfstate`, and `.aws/credentials`.
- **Injected Headers:** Forged `X-Forwarded-For` and `X-Real-IP` values (e.g., `34.94.237[.]62`, `104.28.219[.]193`).
- **User-Agents:** Fake crawler headers (e.g., `Googlebot`, `ClaudeBot`, `GPTBot`, `PerplexityBot`).
- **Detection Methods:** Monitor web server access logs for unusual GET requests targeting the filesystem root via the Vite dev server port (typically 5173).
## References
- **Vendor Advisory:** [https://github[.]com/vitejs/vite/security/advisories/GHSA-v2wj-q39q-566r]
- **F5 Labs Research:** [https://www[.]f5[.]com/labs/articles/cloud-takeover-mass-scanning-for-exposed-vite-endpoints-cve-2026-39364]
- **Original News Source:** [https://thehackernews[.]com/2026/09/mass-scanning-campaign-exploits-vite.html]