CVE-2024-46982 PoC — Cache Poisoning in next.js

Source

https://github.com/CodePontiff/next_js_poisoning

Associated Vulnerability

Title: Cache Poisoning in next.js (CVE-2024-46982)
Description:Next.js is a React framework for building full-stack web applications. By sending a crafted HTTP request, it is possible to poison the cache of a non-dynamic server-side rendered route in the pages router (this does not affect the app router). When this crafted request is sent it could coerce Next.js to cache a route that is meant to not be cached and send a `Cache-Control: s-maxage=1, stale-while-revalidate` header which some upstream CDNs may cache as well. To be potentially affected all of the following must apply: 1. Next.js between 13.5.1 and 14.2.9, 2. Using pages router, & 3. Using non-dynamic server-side rendered routes e.g. `pages/dashboard.tsx` not `pages/blog/[slug].tsx`. This vulnerability was resolved in Next.js v13.5.7, v14.2.10, and later. We recommend upgrading regardless of whether you can reproduce the issue or not. There are no official or recommended workarounds for this issue, we recommend that users patch to a safe version.

Description

 The CVE-2024-46982 is cache poisoning of next_js some site have API to load their image

Readme

CVE-2024-4698 is a cache poisoning vulnerability in Next.js that impacts versions 13.5.1 to 13.5.7, as well as 14.0.0 through 14.2.10. The issue arises when websites leverage the _next/image?url= API with the ?url= parameter, enabling attackers to load images hosted on their own servers. These custom attacker images can also become permanently stored on the victim’s website, even if the attacker stops their Ngrok or Apache service.

Attackers can use tunneling tools like Ngrok or an Apache server to deliver malicious images from their local systems. Additionally, introducing delays in the script can help circumvent protections on servers that enforce timing-based upload restrictions.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →