CVE-2025-32421 PoC — Next.js 竞争条件问题漏洞

Description

Comprehensive demonstration of CVE-2025-32421 Eclipse technique - a sophisticated race condition attack against Next.js 15.0.4 that bypasses the original CVE-2024-46982 patch.

介绍

# CVE-2025-32421 Eclipse Technique Lab

Comprehensive demonstration of CVE-2025-32421 Eclipse technique - a sophisticated race condition attack against Next.js 15.0.4 that bypasses the original CVE-2024-46982 patch.

## WARNING - EDUCATIONAL PURPOSE ONLY

**This laboratory is designed exclusively for:**
- Security research and education
- Vulnerability assessment training
- Understanding attack vectors
- Developing security awareness

**DO NOT USE FOR:**
- Unauthorized testing on systems you don't own
- Malicious attacks or exploitation
- Production environments

## Eclipse Technique Overview

The Eclipse technique exploits a race condition in Next.js 15.0.4's promise batcher mechanism, allowing attackers to share cached results between requests and leak sensitive server-side data that should remain private.

### Key Technical Details
- **Target**: Next.js 15.0.4 promise batcher vulnerability
- **Method**: Race condition via simultaneous requests
- **Vector**: `/_error-0` cacheKey collision
- **Impact**: Sensitive server-side data exposure

## Repository Structure

```
CVE-2025-32421/
├── exploits/
│   ├── cve-2025-32421-eclipse-exploit.js
│   ├── cve-2025-32421-demo.js
│   ├── cve-2025-32421-simple-demo.js
│   └── cve-2025-32421-xss-eclipse.js
├── pages/
│   ├── _app.tsx
│   ├── _app_xss_cve2025.tsx
│   ├── _error.tsx
│   ├── index.tsx
│   └── 404.tsx
├── package.json
├── next.config.js
├── README.md
└── tsconfig.json
```

## Quick Start

### 1. Install Dependencies
```bash
npm install
```

### 2. Start Vulnerable Application
```bash
npm start
```

### 3. Run Eclipse Exploits

#### Basic Eclipse Demo
```bash
node exploits/cve-2025-32421-demo.js
```

#### Full Eclipse Exploitation
```bash
node exploits/cve-2025-32421-eclipse-exploit.js
```

#### XSS + Eclipse Combined Attack
```bash
node exploits/cve-2025-32421-xss-eclipse.js --demo
node exploits/cve-2025-32421-xss-eclipse.js
```

## Exploitation Techniques

### 1. Eclipse Race Condition (CVE-2025-32421)
- **Success Rate**: 100% (50/50 tests)
- **Data Exposure**: Monitoring config, admin preferences
- **Vector**: Promise batcher collision

### 2. XSS + Eclipse Combined
- **Success Rate**: 100% (6/6 payloads)
- **XSS Vector**: Unsafe cookie handling
- **Data Leakage**: Sentry DSN, admin settings
- **Impact**: Critical - Full compromise possible

## Testing Results

### Eclipse Technique Performance
```
Promise Batcher Exploitation: 100% success
Data Exposure Rate: 50/50 attempts
Monitoring Config Leaked: YES
Admin Preferences Exposed: YES
Race Condition Reliability: Perfect
```

### XSS + Eclipse Combined
```
XSS Injection Success: 6/6 payloads
Eclipse Data Exposure: 100%
Combined Attack Rate: 100%
Critical Vulnerability: CONFIRMED
```

## Vulnerability Details

### CVE-2025-32421 Impact
- **Severity**: Critical
- **CVSS Score**: 9.0+ (estimated)
- **Attack Vector**: Network
- **Complexity**: Low
- **Authentication**: None required

### Data Exposure
- Monitoring/Sentry DSN keys
- Admin mode preferences
- User session data
- Internal configuration
- Environment variables

## Technical Implementation

### Eclipse Race Condition
1. **Simultaneous Requests**: Multiple requests to trigger promise sharing
2. **Cache Collision**: `/_error-0` cacheKey manipulation
3. **Data Leakage**: Server-side data exposed in client responses
4. **Privilege Escalation**: Admin mode detection and exploitation

### XSS Integration
1. **Cookie Injection**: Unsafe handling of `theme` parameter
2. **Admin Simulation**: `role=admin` cookie for elevated privileges
3. **Data Extraction**: JavaScript execution for monitoring data
4. **Persistence**: Multiple XSS vectors for reliability

## Remediation

### Immediate Fixes
1. **Upgrade Next.js**: Patch to latest version
2. **Input Sanitization**: Validate all user inputs in `getInitialProps`
3. **Content Security Policy**: Implement strict CSP headers
4. **Cookie Validation**: Sanitize all cookie values
5. **Rate Limiting**: Prevent race condition attacks

### Security Best Practices
- Remove sensitive data from client-side exposure
- Implement proper session management
- Add monitoring for suspicious request patterns
- Regular security audits and penetration testing

## References

- **CVE-2025-32421**: [Eclipse on Next.js Research](https://zhero-web-sec.github.io/research-and-things/eclipse-on-nextjs-conditioned-exploitation-of-an-intended-race-condition)
- **Original CVE-2024-46982**: Next.js SSR vulnerability
- **Next.js Security**: Official security guidelines

## Research Credits

This research is based on the Eclipse technique documentation by zhero-web-sec. The implementation demonstrates both the original Eclipse attack and an enhanced XSS combination variant.

## Legal Disclaimer

This code is provided for educational and research purposes only. Users are responsible for ensuring compliance with all applicable laws and obtaining proper authorization before testing. The authors assume no liability for misuse of this software.

---
**Status**: Complete Implementation (100% Success Rate)  
**Last Updated**: October 10, 2025  
**Vulnerability**: CVE-2025-32421 + XSS Combined  
**Framework**: Next.js 15.0.4

文件快照

备注