Hackers are scanning publicly exposed Vite development servers to steal credentials and configuration data from AWS and Microsoft Azure environments. The campaign exploits a high-severity vulnerability that allows attackers to access files without authentication.
Researchers recorded more than 800 attacks during one month. The hackers searched for environment files, cloud access tokens, Terraform data and other sensitive information.
Hackers Exploit Vite Vulnerability
The Vite server attacks exploit CVE-2026-39364, a high-severity file access vulnerability. It affects Vite versions 7.1.0 through 7.3.2. It also affects releases in the 8.x branch before version 8.0.5.
Security researchers disclosed the flaw on April 7. It allows an unauthenticated attacker to manipulate query parameters in an HTTP GET request.
As a result, the vulnerable server may return files that its security controls should normally protect. Attackers can retrieve this information in plain text without valid login credentials.
Certain parameters cause the server to skip its deny-list filtering. Instead of rejecting the request, it responds with the targeted file and an HTTP 200 status code.
Campaign Generates Thousands of Events
Technology company F5 discovered the campaign through its honeypot sensors. Its researchers recorded more than 800 attacks and around 32,000 raw events within one month.
The activity appears to form part of a broad scanning operation. Attackers are searching the internet for exposed Vite servers instead of focusing on individual organisations.
Most of the malicious traffic originated from the United States, Belgium and the Netherlands. In addition, the attackers used IP addresses associated with Google Cloud infrastructure. This approach may help them hide their origins or avoid basic filtering systems.
The three most active addresses were 34.14.15[.]105, 34.16.200[.]129 and 34.11.196[.]206.
Attackers Search for Cloud Credentials
After finding a vulnerable server, the hackers used extensive wordlists to request valuable files. Their main targets included environment files such as .env, .env.production and .env.local.
These files often contain database passwords, application secrets and API keys. Therefore, exposing one file could give an attacker access to several connected services.
The campaign also searched multiple home directories for AWS credentials. Furthermore, the hackers attempted to retrieve AWS configuration files, backups and other stored authentication data.
Azure credentials and access tokens were another major target. The attackers also looked for Terraform state and variable files, which may reveal sensitive cloud infrastructure details.
Other targets included serverless configuration files and system environment data. The scanners requested information from Linux process directories and tried to access the system’s password file.
If successful, the operation could give attackers enough information to compromise cloud environments. Stolen credentials may allow them to access stored data, deploy resources or move deeper into an organisation’s infrastructure.
Scanners Use Evasion Techniques
The attackers tested several traversal and encoding variations while requesting files. These included double-encoded traversal sequences designed to disguise the final destination of a request.
Such techniques may bypass reverse proxies or web application firewalls that fail to normalise requests correctly. Consequently, a security tool may approve a request before the server decodes its malicious content.
The most active scanning addresses also targeted three other Vite access control vulnerabilities. These flaws include CVE-2025-30208, CVE-2025-31125 and CVE-2024-45811.
Authorities have previously identified CVE-2025-31125 as an actively exploited vulnerability. Therefore, outdated servers may remain exposed through several attack paths.
Why Vite Servers Become Exposed
Vite normally binds its development server to localhost. This default setting prevents external users from accessing it over the internet.
However, developers can expose the server by using the --host option or changing the server.host setting. Incorrect Docker port mappings can also make a development instance publicly accessible.
Development servers may hold credentials and configuration data that production systems need. Yet they often lack the stronger security controls applied to public-facing infrastructure.
Consequently, one configuration error can expose both the server and the secrets stored within its environment.
How Developers Can Protect Vite
F5 recommends updating Vite to the latest available version. Current releases include fixes for the vulnerabilities used during the campaign.
Administrators should also prevent public access to port 5173, which Vite commonly uses. In addition, security teams can block suspicious requests targeting the /@fs/ path.
Developers should not trust crawler User-Agent strings as proof that a request is harmless. Attackers can easily copy or modify these identifiers.
Organisations may also block the three most active IP addresses identified during the campaign. However, address blocking alone will not stop attackers from switching to new cloud infrastructure.
Finally, organisations that exposed an unpatched Vite server should treat accessible secrets as compromised. They should rotate every credential, token and key that the vulnerable system could reach.
0 responses to “Vite Server Attacks Target AWS and Azure Secrets”