来源

关联漏洞

介绍

CVE-2025-29927 Scanner
=====================

This Python script identifies hosts vulnerable to CVE-2025-29927, an improper authorization vulnerability in the Next.js middleware that may allow authentication bypass. The script checks for Next.js usage, identifies the version, detects the x-middleware-subrequest header, and tests for potential authentication bypasses on specified routes.

WARNING: This script is for educational purposes and authorized security audits only. Unauthorized use on systems without explicit permission is illegal and unethical.

Features
--------
- Scans a list of hosts to detect Next.js usage.
- Identifies vulnerable Next.js versions (based on CVE-2025-29927).
- Tests authentication bypass on specified routes (via file or default).
- Supports parallel scanning with multiple threads.
- Automatically creates a routes.txt file with default routes if not provided.

Prerequisites
-------------
- Python 3.6 or higher
- Dependencies listed in requirements.txt

Installation
------------
1. Clone or download this repository:
   git clone <REPOSITORY_URL>
   cd cve-2025-29927-scanner

2. Create and activate a virtual environment (optional, but recommended):
   python -m venv venv
   source venv/bin/activate  # Linux/Mac
   venv\Scripts\activate     # Windows

3. Install the dependencies:
   pip install -r requirements.txt

Usage
-----

1. Prepare a hosts.txt file with a list of hosts (one per line). Example:
   example.com
   subdomain.example.com
   another-site.com

2. (Optional) Prepare a routes.txt file with routes to test (one per line). Example:
   api/auth
   dashboard
   admin
   If not provided, the script will automatically create a routes.txt with default routes.

3. Run the script:
   - Using default routes:
     python cve_2025_29927_scanner.py -f hosts.txt -t 10
   - Using a custom routes file:
     python cve_2025_29927_scanner.py -f hosts.txt -r custom_routes.txt -t 10

   Arguments:
   -f, --file: File with the list of hosts (required).
   -r, --routes: File with the list of routes (optional; uses routes.txt if not specified).
   -t, --threads: Maximum number of threads (default: 10).

4. Check the results in the terminal output.

Example Output
```python

File routes.txt created with default routes.
Starting scan on 3 hosts with 3 routes...
Scan results:
------------------------------------------------------------
Host: https://example.com
Next.js detected: True
Version: 13.5.6
x-middleware-subrequest header: True
Vulnerable (version): True
Authentication bypass possible: True
Status: VULNERABLE
------------------------------------------------------------
```

Dependencies
------------
The dependencies are listed in requirements.txt:
- requests>=2.31.0
- urllib3>=1.26.18

Mitigation for CVE-2025-29927
-----------------------------
- Update Next.js to a non-affected version (see the official advisory: https://nextjs.org/docs/upgrading).
- Review middleware configuration to ensure robust authentication checks (see: https://nextjs.org/docs/middleware).

Contribution
------------
Contributions are welcome

文件快照

 [4.0K]  /data/pocs/5cd6e5bf3fa6fffb3ad204d1bd2c8c3470677b22
├── [8.0K]  CVE-2025-29927_scanner.py
├── [ 34K]  LICENSE
├── [3.0K]  README.md
├── [  34]  requirements.txt
└── [  25]  routes.txt

0 directories, 5 files

备注