Author: DigitalSpying Security Desk
Date: September 15, 2026
Executive Summary
In an aggressive automated threat campaign targeting modern JavaScript, TypeScript, and React developers, cybersecurity researchers from F5 Labs—as reported by The Hacker News—have exposed widespread mass-scanning operations designed to extract cloud credentials and infrastructure secrets from internet-exposed Vite development servers.
The campaign weaponizes CVE-2026-39364 (CVSS 8.2), a high-severity security restriction bypass flaw affecting the Vite build tool and development server. By appending crafted query parameters (such as ?raw or ?import&raw) to requests targeting Vite’s internal /@fs/ file system endpoint, adversaries successfully bypass server.fs.deny protections that are meant to safeguard sensitive project files. Operating through cloud hosting networks and disguising requests with spoofed artificial intelligence crawler User-Agents (including ClaudeBot, GPTBot, and PerplexityBot), attackers are harvesting root .env files, AWS/Azure access tokens, Terraform state files (terraform.tfstate), and live process memory across hundreds of development, staging, and containerized preview deployments.
Deep-Dive Technical Analysis
1. Vulnerability Mechanics: Bypassing server.fs.deny via Query Parameters
Vite has become the standard frontend development server for frameworks like Vue, React, and Svelte, relying on native ES modules (ESM) to serve project files on-demand over HTTP without prior bundling:
* The /@fs/ Gateway: To support modern workspace architectures (such as monorepos) where components or styles reside outside the immediate project root directory, Vite provides an internal routing endpoint—/@fs/—which accepts arbitrary absolute filesystem paths.
* Access Control Layers (server.fs.allow vs. server.fs.deny): To prevent malicious clients from reading sensitive host files, Vite implements an explicit denial list (server.fs.deny), configured by default to block files matching patterns such as .env, .env.*, *.crt, *.pem, and .git.
* The Query Parameter Sanitization Gap (CVE-2026-39364): In vulnerable Vite versions, the security filter evaluating server.fs.deny performs string matching on the raw request path. When an attacker appends specific query parameters—such as ?raw, ?import&raw, or ?import&url&inline—the path comparison algorithm fails to match the blacklisted pattern against the file path.
* Plaintext Content Disclosure: Because the underlying file loading handler strips the query parameters before retrieving the file from the operating system disk, the request successfully resolves the target file, returning its full plaintext contents inside an HTTP 200 OK response.
+----------------------------------------------------------------------------------------------------+
| CVE-2026-39364 VITE DEV SERVER EXPLOIT |
|---|+----------------------------------------------------------------------------------------------------+
[Automated Attacker Scanner]
|
| 1. HTTP GET /@fs/proc/self/cwd/.env?raw
| User-Agent: Mozilla/5.0 (compatible; ClaudeBot/1.0; +claudebot@anthropic.com)
v
[Internet-Exposed Vite Dev Server (Bound via --host 0.0.0.0)]
|
| 2. Evaluates server.fs.deny: Fails to match regex due to '?raw' parameter
v
[Bypass Succeeded (CWE-20 / Security Restriction Bypass)]
|
| 3. File Loader Reads /proc/self/cwd/.env from Disk
v
[HTTP 200 OK Response]
Body: AWS_ACCESS_KEY_ID=AKIA...
AWS_SECRET_ACCESS_KEY=wJalr...
DATABASE_URL=postgres://admin:secret@db.internal:5432/prod
2. The Misconfiguration Catalyst: The --host Network Trap
Under default out-of-the-box configurations, Vite binds strictly to the loopback interface (127.0.0.1 / localhost), preventing external network access. However, developers routinely expose Vite servers to the public internet due to operational friction:
* Local Device Testing & Containerization: To test web applications on mobile devices on the same Wi-Fi, or to run Vite within Docker containers, developers frequently pass the --host CLI flag or set server: { host: '0.0.0.0' } in vite.config.js.
* Cloud Preview Deployments: In cloud development environments (such as AWS EC2, DigitalOcean droplets, or Kubernetes dev clusters), exposing container ports without perimeter firewalls or reverse proxies leaves the Vite development server directly reachable by internet scanners.
3. Targeted Intelligence: What Attackers Are Harvesting
Telemetry compiled by F5 Labs reveals a sophisticated reconnaissance methodology targeting specific cloud and runtime artifacts:
* Direct Working Directory Inspection: Rather than guessing absolute web root paths, scanners query: GET /@fs/proc/self/cwd/.env?raw. This leverages Linux's virtual /proc filesystem to automatically resolve the .env file of the current working directory.
* Process Memory & Runtime Secrets: Probing /@fs/proc/self/environ?raw and /@fs/proc/1/environ?raw exposes all environment variables injected into the container at launch, frequently revealing Kubernetes service tokens, database credentials, and internal API keys.
* Cloud Profiles & Infrastructure State:
* /@fs/root/.aws/credentials?raw and /@fs/home/*/.aws/credentials?raw
* /@fs/.../terraform.tfstate?raw (exposing complete infrastructure topologies and database passwords)
* /@fs/.../serverless.yml?raw and Azure configuration profiles.
4. Evasion Tradecraft: Bot Impersonation & Header Forgery
To avoid triggering standard web application firewall (WAF) rate limits and security logging alarms, the scanning campaign utilizes elaborate evasion techniques:
* Crawler Spoofing: Requests forged User-Agent headers mimicking prominent web crawlers and AI search bots, specifically ClaudeBot, GPTBot, PerplexityBot, OAI-SearchBot, and Googlebot.
* Cloud Infrastructure Routing: Attackers routed scan traffic through Google Cloud Platform (GCP) subnets (34.x and 35.x), blending in with legitimate cloud service communications.
* Header Poisoning: Injected forged X-Forwarded-For and X-Real-IP headers to mislead proxy logs and circumvent primitive IP-based access control lists.
Industry Impact: When Development Leaks Production
The campaign illustrates the severe consequences of blurriness between development and cloud production environments:
* Lateral Cloud Infiltration: When an exposed Vite server leaks an AWS access key or Terraform state file, the breach is not confined to the frontend application. Adversaries use those credentials to authenticate directly against corporate cloud infrastructure, accessing S3 buckets, internal databases, and Kubernetes clusters.
* Software Supply Chain Poisoning: Leaking internal package registry tokens (such as private npm or GitHub tokens) allows adversaries to publish malicious code updates into enterprise repositories.
Strategic Recommendations & Mitigations
1. Upgrade Vite Immediately
* Ensure all projects utilizing Vite are updated to the latest patched releases where query parameters appended to /@fs/ paths are strictly evaluated and stripped before enforcing server.fs.deny.
2. Restrict Network Bindings & Container Exposure
* Never Bind to 0.0.0.0 on Public Interfaces: Ensure development servers bind strictly to localhost (127.0.0.1).
* Enforce VPN/Tunnel Access: If remote previewing is necessary, access development environments exclusively through authenticated SSH tunnels, WireGuard VPNs, or secure tunneling services (such as Cloudflare Tunnels) protected by access controls.
3. Eliminate Plaintext Secrets
* Sanitize .env Files: Never store production credentials, cloud administrative keys, or live database passwords in local .env files.
* Implement Secrets Managers: Utilize ephemeral credentials (such as AWS IAM Roles for EC2/EKS) or dedicated secrets managers (HashiCorp Vault, Doppler, AWS Secrets Manager) rather than static disk files.
4. Detection & WAF Rules
* Configure reverse proxies and WAFs to immediately drop any external HTTP requests containing /@fs/ in the URI path.
* Alert on HTTP GET requests attempting to read files within /proc/ or files ending with .env, .pem, or .tfstate.