Summary
A mass-scanning campaign is exploiting a file disclosure vulnerability in Vite development servers to steal cloud credentials and infrastructure configuration files. Attackers bypass access controls using crafted query parameters to retrieve sensitive data like AWS keys and .env files from exposed instances.
Take Action:
If you run Vite development servers, make sure they are not exposed to the internet. Bind them to localhost, block port 5173 at the firewall, and use a VPN if remote access is needed. Then update to Vite 7.3.2 or 8.0.5, rotate any credentials (cloud keys, tokens, passwords) that were stored on exposed machines, and check your logs for requests to /@fs/ to see if anyone already got in.
Read the full article on BeyondMachines
This article was originally published on BeyondMachines
Top comments (0)