Mass scanners are pulling AWS keys and Terraform state from Vite dev servers exposed with --host

The request is an ordinary HTTP GET. It goes to the /@fs/ endpoint, names a file path, and appends a bypass parameter. The server processes it, the server.fs.deny check does not hold, and the file comes back as plaintext in the response body ^[7]. Vite described the failure in its April advisory: "On the Vite dev server, files that should be blocked by server.fs.deny (e.g., .env, *.crt) can be retrieved with HTTP 200 responses when query parameters such as ?raw, ?import&raw, or ?import&url&inline are appended" ^[4].

Three conditions have to hold for an app to be affected. The dev server has to be exposed to the network with --host or the server.host option. The file has to sit in a directory allowed by server.fs.allow. And it has to be denied by a pattern in server.fs.deny ^[5]. Vite binds to localhost by default, and F5 said developers undo that by passing --host, setting server.host, or misconfiguring Docker container port mappings ^[6].

The target list is specific. Wordlists covered .env, .env.production and .env.local, AWS credential files across several possible home directories, AWS config files and credential backups, Azure credentials and access tokens, Terraform state and variable files, and serverless configuration and state ^[23]. The same requests reached for /etc/passwd, /proc/self/environ, /proc/1/environ and /proc/self/cwd/.env ^[8]. On that last path, F5 said: "Probing /proc/self/cwd/.env demonstrates an understanding of the deployment stack, reading the active .env file relative to the running process without needing to guess the absolute web application path" ^[9].

F5's honeypot sensors recorded more than 800 attacks and roughly 32,000 raw events over a month ^[15]. That works out to about 40 requests per attack and roughly 27 attacks a day ^[1][2]. Each targeted host was walked through a long list of paths.

The evasion is aimed at the log pipeline as much as the filter. Requests carried forged User-Agent headers impersonating Googlebot, ClaudeBot, GPTBot, PerplexityBot, OAI-SearchBot and Amazonbot ^[10]. They also injected X-Forwarded-For and X-Real-IP values such as 34.94.237[.]62 and 104.28.219[.]193 to get past IP-based access lists and complicate log analysis ^[11]. F5 also saw traversal and encoding variants, including double-encoded sequences, apparently to survive reverse proxy or WAF normalisation ^[17]. Its guidance includes not trusting crawler User-Agent strings ^[19].

Disclosure was April 7 ^[14]. The harvesting ran in August 2026 ^[2], about four months later ^[3]. The most active addresses also used CVE-2025-30208, CVE-2025-31125, which has been flagged as actively exploited, and CVE-2024-45811, all Vite access-control flaws ^[18]. Traffic came from Google Cloud Platform ranges in 34.x and 35.x ^[12], with 34.14.15[.]105, 34.16.200[.]129 and 34.11.196[.]206 named as the top sources to blocklist ^[20].

The two published accounts of F5's data differ on geography: The Hacker News lists the United States, Belgium, the Netherlands, Singapore and Taiwan as the main origins ^[12], while BleepingComputer lists the first three ^[22].

Fixes are version bumps and port hygiene. Affected builds are Vite 7.1.0 through 7.3.2 and the 8.x branch before 8.0.5 ^[13], and F5 recommends updating, blocking access to port 5173, and blocking suspicious /@fs/ requests ^[19]. Where an unpatched server was publicly exposed, F5 recommends rotating every secret within reach of it ^[21].