Attackers Exploit Vite Dev Server Feature to Steal Files
Vite is a frontend development tool that listens on port 5173 and includes a feature allowing file retrieval with the prefix '/@fs/'. Attackers are exploiting CVE-2025-30208 by appending a '?raw??' suffix to bypass Vite's directory access restrictions and download arbitrary files like '/etc/environment' and AWS credentials. These attacks are low volume but targeted, probing common web ports rather than the default Vite port, indicating attackers expect proxied or misconfigured servers. Exposed Vite dev servers often contain plaintext secrets, making this a high-risk issue for any internet-facing development environment. Practitioners should verify no Vite dev servers are publicly accessible, monitor for '/@fs/' and '?raw??' in logs, and rotate any exposed credentials.