CTI · corroborated · 2026-09-17

Mass scanning targets exposed Vite dev servers for cloud secrets via CVE-2026-39364

Full story & timeline

MITRE ATT&CK

• T1190 Exploit Public-Facing Application Initial Access
• T1083 File and Directory Discovery Discovery
• T1552 Unsecured Credentials Credential Access

Indicators

Observables tied to this case, from the curated feed. raw sidecar

• cybersecurefox.com domain · active · corroborated

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: Mass Scanning for Exposed Vite Dev Server Secrets
id: b4e8d3f2-9c5a-4f0b-a7d6-e23456789012
status: experimental
description: Detects scanning of exposed Vite development servers for cloud credentials and sensitive files via CVE-2026-39364 path traversal. Attackers use /@fs/ endpoints with query obfuscation to bypass server.fs.deny restrictions.
references:
  - https://dev.to/anoymask/vite-cve-2026-39364-exploring-cloud-secrets-from-exposed-development-servers-43fc
author: Tia N. List
date: 2026/09/17
tags:
  - attack.t1190
  - attack.initial-access
  - attack.t1083
  - attack.discovery
logsource:
  category: webserver
detection:
  selection:
    cs-uri|contains: '/@fs/'
  selection_suspicious:
    cs-uri|contains:
      - '.env'
      - 'aws'
      - 'azure'
      - 'terraform'
      - 'proc/self'
  filter:
    cs-uri|endswith:
      - '.js'
      - '.ts'
      - '.mjs'
  condition: selection and selection_suspicious and not filter
falsepositives:
  - Legitimate development workflows accessing local files via Vite dev server
level: medium

References

• https://dev.to/anoymask/vite-cve-2026-39364-exploring-cloud-secrets-from-exposed-development-servers-43fc