Yeah it’s over for NextJS... 13 NEW vulnerabilities

하이라이트

• Next.js and React released fixes for 13 new CVEs, with 6 categorized as high-severity vulnerabilities including Denial of Service and Server-Side Request Forgery.

• A middleware bypass in the Pages Router exists when i18n is enabled because the base URL case fails to trigger the security matcher that protects locale-specific variants.

• A React Server Components DoS vulnerability allows attackers to force 200 million string comparisons by sending 200,000 random keys and 1,000 pointers in a single payload.

• Server-Side Request Forgery (SSRF) with an 8.6 severity score allows unauthorized access to internal services like Redis or databases by spoofing the request target via a WebSocket upgrade header.

• Next.js cache poisoning occurs when a query string appended to a Server Component request bypasses the .rsc extension check, causing the CDN to serve serialized data as HTML.

• Cross-site scripting (XSS) in beforeInteractive scripts arises from JSON.stringify failing to escape HTML closing tags, allowing malicious script injection via search parameters.

타임라인

1. 00:00 - 03:51

   Middleware and Proxy Bypass in Pages Router

   The system redirects unauthorized users to a login page for locale-specific paths like /en/secret but fails to do so for the base /secret path. By inspecting the next-data script to find the build ID, a user can construct a direct URL to the underlying JSON data. This bypasses the intended middleware protection entirely. Security best practices dictate that sensitive data should be protected by server-side authorization logic rather than relying solely on middleware routing.

   • Middleware fails to protect the base path of a route when the i18n configuration is active.
   • Attackers can access sensitive server-side props by requesting the .json data file associated with a build ID.
   • The vulnerability stems from faulty code that excludes the default locale variant from the security matcher.
2. 03:51 - 07:48

   Denial of Service via React Server Components

   In the vulnerable version, the server performs a fresh pass over all keys for every pointer defined in the payload. This creates a computational bottleneck where the number of operations is the product of the keys and the pointers. The fix implements a cursor-based system where the cursor moves forward only once through the key list. This optimization reduces the complexity from k*n to n+k, bringing 200 million operations down to approximately 201,000.

   • A 7.5 severity vulnerability in the react-server-dom package allows attackers to block the server thread for several seconds.
   • The React flight protocol uses a pointer system for deserializing form data that scales quadratically under attack.
   • A payload with 200,000 keys and 1,000 pointers forces the server into 200 million string comparisons.
3. 07:48 - 10:57

   Server-Side Request Forgery in Self-Hosted Environments

   When a request contains a WebSocket upgrade header, the Next.js server uses the provided request target as the destination for a proxy request. If this target is an internal localhost URL, the Next.js server fetches the data and returns it to the external attacker. Vercel-hosted deployments were not impacted by this specific flaw. The patched code introduces a status code check and a 'finished' boolean to ensure only legitimate internal routes are processed.

   • The highest severity vulnerability (8.6) affects self-hosted Next.js applications through the upgrade: websocket header.
   • Attackers can bypass firewalls to access internal services like databases or Redis by manipulating the request target.
   • The resolution involves adding guards to the resolveRoutes function to validate proxy requests before execution.
4. 10:57 - 15:51

   Cache Poisoning and XSS Vulnerabilities

   The cache poisoning flaw relies on the fact that the server component check only looked for the .rsc extension at the very end of the URL. By adding a query string, an attacker tricks the CDN into caching raw serialized data as if it were a standard HTML page. In the XSS case, the use of dangerouslySetInnerHTML combined with unescaped JSON strings allows an attacker to terminate the current script block and start a new, malicious one. This can be exploited to steal session cookies or display fake login forms.

   • Cache poisoning occurs because the system incorrectly identifies server component data as HTML when a query string is present.
   • Cross-site scripting (XSS) is possible in scripts using the beforeInteractive strategy with untrusted search parameters.
   • The XSS flaw exists because JSON.stringify does not escape the closing script tag characters.