Ethical Hacking News
A recent mass-scanning campaign has been exploiting a Vite vulnerability to extract cloud credentials from exposed development servers. The campaign, which began in August 2026, has been using an automated effort to steal sensitive data from internet-exposed Vite development servers, leveraging an exploit for CVE-2026-39364. The successful exploitation of this vulnerability requires three conditions to be met, and attackers have been observed using bogus User-Agent headers to get around IP-based access lists and complicate log analysis. The malicious activity has originated from several countries, including the U.S., Belgium, the Netherlands, Singapore, and Taiwan. Organizations are urged to take immediate action to secure their Vite development servers and prevent similar attacks.
The Vite vulnerability CVE-2026-39364 has been exploited in a recent cybersecurity campaign, allowing attackers to steal sensitive data from cloud-secured development servers. The campaign targets internet-exposed Vite development servers, aiming to steal cloud credentials, configurations, and infrastructure state files. The vulnerability involves files that should be blocked by server.fs.deny, but can be retrieved with HTTP 200 responses when query parameters are appended. Attackers must meet three conditions to exploit the vulnerability: exposing the server to the network, allowing sensitive files, and denying them with a specific pattern. The campaign has been observed to conduct reconnaissance and extract sensitive data, including environment configurations, AWS credentials, and cloud administrative credentials. Organizations must take immediate action to secure their Vite development servers by configuring server.fs.allow and implementing additional security measures.
A recent cybersecurity campaign has garnered significant attention for its exploitation of a Vite vulnerability, compromising the security of cloud-secured development servers. According to F5 Labs, the research arm of cyber security firm F5 Networks, the campaign, which began in August 2026, has been using an automated effort to steal sensitive data from exposed Vite development servers.
The first of these automated efforts targets internet-exposed Vite development servers, with the aim of stealing cloud credentials, configurations from Amazon Web Services (AWS) and Microsoft Azure instances, and infrastructure state files. The campaign has been found to leverage an exploit for CVE-2026-39364, a high-severity security flaw in Vite that could permit an unauthenticated attacker to bypass security restrictions via query parameter manipulation and leak sensitive data, including files specified by server.fs.deny.
The vulnerability, which was disclosed by Vite in an advisory in April 2026, involves files that should be blocked by server.fs.deny, such as .env and *.crt files, being retrieved with HTTP 200 responses when query parameters such as ?raw, ?import&raw, or ?import&url&inline are appended. The successful exploitation of this vulnerability, however, requires three conditions to be met for an app to be deemed affected.
The first condition is that the Vite development server must explicitly expose itself to the network using the --host or server.host config option. The second condition is that the sensitive file must exist in the allowed directories specified by server.fs.allow. The third condition is that the sensitive file is denied with a pattern that matches a file by server.fs.deny.
When these conditions are met, attackers can issue an HTTP GET request to the /@fs/ endpoint, referencing a sensitive file path and appending bypass query parameters. This causes the server to process the request, while undermining the server.fs.deny check, and ultimately return the contents of the requested file in plaintext in the HTTP response body.
This can have severe implications, particularly when the request is used to target configuration directories, granting the attackers unauthorized access to plaintext API secrets, database passwords, and cloud administrative credentials. The campaign has been observed to conduct reconnaissance and extract a variety of sensitive data, including environment configurations, AWS credentials, AWS configurations and backups, infrastructure state files, and system memory and environment details.
The attackers have also been seen using bogus User-Agent headers impersonating major web crawlers and artificial intelligence bots, such as Googlebot, ClaudeBot, GPTBot, PerplexityBot, OAI-SearchBot, and Amazonbot. These headers are used to get around IP-based access lists and complicate log analysis. The malicious activity has originated from several countries, including the U.S., Belgium, the Netherlands, Singapore, and Taiwan, with the attackers using Google Cloud Platform ranges to fly under the radar.
In light of this campaign, it is essential for organizations to take immediate action to secure their Vite development servers and prevent similar attacks. This can be done by ensuring that the --host or server.host config option is not set to expose the development server to the network, by configuring server.fs.allow to restrict sensitive files, and by implementing additional security measures to prevent query parameter manipulation.
Furthermore, organizations should also consider implementing a robust security posture, including regular vulnerability scanning, patch management, and incident response planning. By taking proactive steps to secure their development servers, organizations can minimize the risk of a successful attack and protect their sensitive data.
Related Information:
https://www.ethicalhackingnews.com/articles/Mass-Scanning-Campaign-Exploits-Vite-Flaw-to-Extract-Cloud-Credentials-from-Exposed-Dev-Servers-ehn.shtml
https://thehackernews.com/2026/09/mass-scanning-campaign-exploits-vite.html
Published: Tue Sep 15 07:41:58 2026 by llama3.2 3B Q4_K_M
