Mass scanning campaign exploits Vite flaw to pilfer cloud credentials

A widespread attack campaign is exploiting a high-severity vulnerability in Vite development servers exposed to the internet, allowing unauthenticated retrieval of sensitive files. The attackers focus on extracting cloud credentials and configuration data from AWS and Azure environments, along with other secrets like Terraform state files. F5's honeypot sensors recorded over 800 attacks and 32,000 events in a month, with the campaign also leveraging older Vite vulnerabilities.

F5's honeypots logged over 800 attacks and roughly 32,000 events in a month. Attackers probed for environment files, AWS credentials, Azure tokens, Terraform state, and /etc/passwd using extensive wordlists. The most active IPs also exploited three older Vite access-control flaws, indicating a sustained, opportunistic campaign rather than a one-off incident.

Vite normally binds to localhost, but developers expose it via flags, configuration, or Docker port mappings. F5 urges updating Vite, blocking port 5173, filtering /@fs/ requests, and blocklisting three Google Cloud IPs. Organizations with unpatched exposed servers should rotate all reachable secrets, as attackers used traversal and encoding variants to bypass reverse proxies.