Mass Scanning for Exposed Dev Servers
A widespread scanning campaign is targeting internet-exposed Vite development servers in an attempt to steal cloud credentials from AWS and Azure environments. The campaign exploits CVE-2026-39364, a high-severity vulnerability affecting Vite versions 7.1.0–7.3.2 and 8.x before 8.0.5.
How the Exploit Works
Attackers append parameters such as ?raw or ?import&raw to HTTP requests sent to a vulnerable Vite dev server. The server fails to enforce its deny-list filtering for these request patterns and serves the requested file's contents in plaintext with an HTTP 200 response — bypassing the protections meant to keep local files off-limits to unauthenticated network requests.
What Attackers Are After
| Target | Purpose |
|---|---|
.env files and variants | Application secrets, API keys, database credentials |
| AWS credential/config files | Cloud account takeover |
| Azure tokens and credentials | Cloud account takeover |
| Terraform state files | Infrastructure secrets and topology |
/proc/self/environ | Full process environment variables |
Scale of the Campaign
Security firm F5 detected over 800 attacks generating approximately 32,000 events in a single month through its monitoring telemetry. Most of the malicious activity originated from IP ranges in the United States, Belgium, and the Netherlands, with attackers routing traffic through Google Cloud IP space to obscure their origin.
Why This Matters
Vite's dev server is meant to run only in local development, but it's routinely left exposed — bound to 0.0.0.0 and reachable from the internet — in cloud sandboxes, CI runners, and misconfigured containers. A single exposed instance can hand an attacker the same AWS or Azure credentials a developer uses locally, often with far broader permissions than a production service account.
Recommendations
- Update Vite immediately to a patched release (8.0.5+, or the latest 7.x patch that addresses CVE-2026-39364)
- Never expose the dev server (default port
5173) to the public internet — bind tolocalhostor restrict via firewall/VPN - Filter or alert on
/@fs/,?raw, and?import&rawrequests at the edge if a dev instance must be reachable - Rotate all credentials that may have been present in
.envfiles or process environment on any exposed instance - Treat CI/sandbox environments as production for credential-scoping purposes — least-privilege IAM limits blast radius