The CVE-2024-46982 is cache poisoning of next_js some site have API to load their imageCVE-2024-4698 is a cache poisoning vulnerability in Next.js that impacts versions 13.5.1 to 13.5.7, as well as 14.0.0 through 14.2.10. The issue arises when websites leverage the _next/image?url= API with the ?url= parameter, enabling attackers to load images hosted on their own servers. These custom attacker images can also become permanently stored on the victim’s website, even if the attacker stops their Ngrok or Apache service.
Attackers can use tunneling tools like Ngrok or an Apache server to deliver malicious images from their local systems. Additionally, introducing delays in the script can help circumvent protections on servers that enforce timing-based upload restrictions.
登录后查看神龙缓存的 POC 文件快照
登录查看