CVE-2024-34351 PoC — ZEIT Next.js代码问题漏洞

Description

PoC for a full exploitation of NextJS SSRF (CVE-2024-34351) 

介绍

# CVE-2024-34351 Exploit

- [CVE-2024-34351 PoC](https://github.com/azu/nextjs-CVE-2024-34351/)
- [Next.js Server-Side Request Forgery in Server Actions · CVE-2024-34351 · GitHub Advisory Database](https://github.com/advisories/GHSA-fr5h-rqp8-mj6g)
- [Digging for SSRF in NextJS apps](https://www.assetnote.io/resources/research/digging-for-ssrf-in-nextjs-apps)

## Summary

PoC for a full exploitation of NextJS SSRF. An attacker can get any website content from Next.js server using CVE-2024-34351 vulnerability.
This vulnerability is fixed in `next@14.1.1`.

## Usage

- Prepare a redirect server.
```
deno run --allow-net --allow-read attacker-server.ts
```
- Modify `Host` header to attacker server
- Modify `Origin` header to attacker server
- Finally you can change the resource placed in the `Origin` header to specify where to redirect to

![Example 1](examples/1.png)
![Example 2](examples/2.png)

文件快照

备注