The attackers specifically target sensitive files including AWS and Azure credentials, infrastructure state files (terraform.tfstate), serverless configurations, and system files like /etc/passwd or .env files. The campaign utilizes cloud provider IP ranges and spoofed User-Agent strings (mimicking popular crawlers like Googlebot and ClaudeBot) to evade detection and circumvent IP-based access control lists. This activity poses a critical risk to organizations that have misconfigured development environments, potentially leading to full cloud administrative compromise.

Attack Chain

1. Attacker performs mass scanning to identify Vite development servers exposed via the --host flag or Docker misconfiguration.
2. Attacker sends HTTP GET requests to the /@fs/ endpoint of the target Vite server.
3. Attacker appends malicious query parameters (?raw, ?import&raw, or ?import&url&inline) to the URI to bypass the server.fs.deny logic.
4. Attacker includes forged 'X-Forwarded-For' and 'X-Real-IP' headers to bypass potential IP-based filtering or rate-limiting.
5. Attacker impersonates legitimate search engines or AI bots via 'User-Agent' headers to avoid automated security alerts.
6. The Vite server processes the request, ignores the deny list due to the bypass, and returns the contents of the target sensitive file in the HTTP response body.
7. Attacker parses the plaintext response to extract API secrets, cloud credentials, and deployment environment variables for further access.

Impact

Successful exploitation allows attackers to gain unauthorized access to cloud environments, internal configuration, and secrets. This has resulted in the theft of AWS credentials, Azure profiles, and infrastructure state files. The wide-scale nature of the campaign affects any organization using misconfigured Vite development servers, with observed activity originating from multiple global regions. Failure to mitigate this vulnerability risks complete lateral movement and compromise of production cloud infrastructure.

Recommendation

Prioritize auditing all Vite development deployments to ensure they are not exposed to the internet.

• Immediately restrict Vite development server access to 'localhost' (default) and verify that no '--host' or 'server.host' flags are used in public-facing or non-secured environments.
• Deploy the webserver-based Sigma rule provided in this brief to detect the specific query parameter bypass attempts on the /@fs/ endpoint.
• Monitor proxy and web server logs for requests containing suspicious query parameters (?raw, ?import&raw) combined with spoofed crawlers in the User-Agent field.
• Revoke and rotate any credentials or secrets found on servers where Vite was exposed to the network.