来源

关联漏洞

描述

→ poc for CVE-2025-29927

介绍

# PoC-CVE-2025-29927

## what is the vuln?
- this cve reports an flaw in the header ```x-middleware-subrequest```, responsible to takes internal requests in next.js, who allow an attacker bypass the authorization middlewares in next.js 15.0.0 and acess protected routes, for example

## real example
- in a webapp, there is the /dashboard route, who only logged users can acess, but, if we make the request with the heade ```x-middleware-subrequest: middleware:middleware:middleware:middleware:middleware```, we can access this route without authentication
  
   <img width="1397" height="612" alt="image" src="https://github.com/user-attachments/assets/fc4de14a-617e-4812-86b2-608526318974" />

文件快照

 [4.0K]  /data/pocs/7928ab41ac7a6d7d3752a17cd74625c92c817514
└── [ 697]  README.md

0 directories, 1 file

备注