Affected Systems

Vite development servers exposed to the internet via --host flag or server.host configuration. Affects deployments where sensitive files exist in server.fs.allow directories and are matched by server.fs.deny patterns. Primary targets: AWS and Azure credentials, Terraform state files, environment variables.

Exploitation Status

Active mass-scanning campaign observed in August 2026. Attackers exploiting CVE-2026-39364 (CVSS 8.2) to bypass server.fs.deny restrictions using query parameters (?raw, ?import&raw, ?import&url&inline). Requests originate primarily from US, Belgium, Netherlands, Singapore, and Taiwan using Google Cloud Platform IP ranges.

Business Impact

Attackers extract plaintext AWS credentials, Azure profiles, database passwords, API secrets, Terraform state files (terraform.tfstate), and serverless configurations. Compromised cloud credentials enable unauthorized access to production infrastructure. Default Vite configurations bind to localhost and are not vulnerable; only explicitly exposed dev servers are at risk. Attackers use spoofed User-Agent headers (Googlebot, ClaudeBot, GPTBot) and forged X-Forwarded-For headers to evade detection.

Urgency

🔴 Immediate

Recommended Actions

  • Immediately audit all Vite development servers for internet exposure; search for --host flag usage, server.host configurations, and Docker port mappings exposing port 5173
  • Patch Vite to version addressing CVE-2026-39364 (released April 2026 or later) on all development and staging environments
  • Block external access to Vite dev servers at firewall and network level; restrict to localhost or internal VPN-only access
  • Review web server logs for requests to /@fs/ endpoint with query parameters ?raw, ?import&raw, or ?import&url&inline; correlate with User-Agent strings mimicking Googlebot, ClaudeBot, GPTBot, PerplexityBot, OAI-SearchBot, Amazonbot
  • Rotate all AWS credentials, Azure service principals, database passwords, and API keys on systems where exposed Vite servers were detected; assume compromise if exposure confirmed
  • Implement network-level controls to prevent dev servers from binding to 0.0.0.0; enforce localhost-only binding in CI/CD pipelines and container orchestration