VulnSocial

CVE-2024-45811Active Exploitation

MEDIUMCVSS 4.8 · MEDIUM

Exploitation ongoing with high activity in latest observed window (2 mentions)

Immediate actions

  • Patch affected systems immediately
  • Assume compromise if assets are exposed

Recommended action window: Immediate (within 24h)

NVD description

Vite a frontend build tooling framework for javascript. In affected versions the contents of arbitrary files can be returned to the browser. `@fs` denies access to files outside of Vite serving allow list. Adding `?import&raw` to the URL bypasses this limitation and returns the file content if it exists. This issue has been patched in versions 5.4.6, 5.3.6, 5.2.14, 4.5.5, and 3.2.11. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Back to dashboard
4.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-200CWE-284

Priority

MEDIUM

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Active exploitation appears in 3 classified signals
  • Patch or workaround signal is available
  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Active exploitation reported across 3 signals
  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Peaked at 2 mentions on most recent observed day (2026-09-15)
  • 3 total mentions across 2 days

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-09-14: 1Mentions · 2026-09-15: 2Active Exploitation · 2026-09-14: 1Active Exploitation · 2026-09-15: 2Patch / Workaround · 2026-09-14: 1Technical Details · 2026-09-14: 1Technical Details · 2026-09-15: 109-1409-15
Signal classification1 categories
Active Exploitation
3100.0%
Referenced assets1 URL
Classification over time
DateTotalLabels
2026-09-141
Active Exploitation1
2026-09-152
Active Exploitation2
Full discourse3 posts
  • Threat Landscape@LandscapeThreat
    Active Exploitation

    A mass-scanning operation is exploiting exposed Vite development servers to retrieve cloud credentials, configuration data, and other secrets from AWS and Azure environments. - Attackers exploit CVE-2026-39364 by manipulating query parameters to bypass file-access restrictions and return protected files in plaintext. - Scanning targets environment files, AWS and Azure credentials, Terraform state, serverless configurations, process environment data, and system files, with traversal and encoding variants used to evade filtering. - F5 observed more than 800 attacks and approximately 32,000 events over one month; activity originated mainly from the United States, Belgium, and the Netherlands and used Google Cloud IP ranges. - Related activity also exploited CVE-2025-30208, CVE-2025-31125, and CVE-2024-45811. Exposed servers should be patched and reachable secrets rotated.

    Post summary

    The text reports active, large-scale exploitation of CVE-2026-39364 (and related CVEs) against exposed Vite development servers to steal cloud credentials, citing specific attack volumes observed by F5 and urging immediate patching and secret rotation.

    0002082
    124 followersView on X
  • Threat Landscape@LandscapeThreat
    Active Exploitation

    Automated scanning in August 2026 increasingly exploited exposed Vite development servers to steal cloud credentials and deployment data. - Attackers abused CVE-2026-39364, an unauthenticated access-control bypass affecting specified Vite versions, by manipulating query parameters on the internal @ fs route. - Scanners also tested CVE-2025-30208, CVE-2025-31125, and CVE-2024-45811 using extensive wordlists targeting environment files, AWS and Azure credential stores, Terraform state, serverless artifacts, and Linux process data. - Honeypot telemetry recorded 807 session-grouped attacks and approximately 32,000 raw events; exposed files could enable cloud account takeover, lateral movement, or broader infrastructure compromise. VULNERABILITY CVE-2024-45811 CVE-2025-30208 CVE-2025-31125 CVE-2026-39364

    Post summary

    The text reports active real-world exploitation of Vite development servers through CVE-2026-39364 and related scanning activity, supported by honeypot telemetry and technical abuse details. No patch or named exploit tool is mentioned.

    0001044
    74 followersView on X
  • Aviatrix Threat Research Center@aviatrixtrc
    Active Exploitation

    TRC analysis shows mass exploitation of CVE-2024-45811 targeting exposed Vite dev servers. Attackers used query parameter manipulation to harvest AWS and Azure credentials from config files. Runtime segmentation helps contain post-compromise lateral movement through cloud infrastructure. #CloudSecurity 🔗 Full TRC analysis: https://aviatrix.ai/threat-research-center/hackers-target-exposed-vite-dev-servers-cve-2026-39364

    Post summary

    The tweet reports mass exploitation of CVE-2024-45811 against exposed Vite dev servers, using query parameter manipulation to harvest cloud credentials, confirming active in‑the‑wild exploitation.

    0001062
    2.0K followersView on X

Explore more

Back to dashboard