Listen to this Post
The vulnerability CVE-2024-34351 in Next.js involves a Server-Side Request Forgery (SSRF) flaw in the framework’s handling of certain request operations. Specifically, it affects the `next.config.js` rewrite rules or similar proxy functionalities, where user-supplied input is insufficiently validated when constructing server-side HTTP requests. Attackers can craft malicious requests containing specially crafted URLs that trick the Next.js server into making unauthorized HTTP requests to internal or restricted systems. This occurs because the vulnerable code does not properly restrict URL schemes or destinations, allowing attackers to specify internal IP addresses, loopback interfaces, or cloud metadata endpoints. The issue is exacerbated when Next.js is deployed in environments where the server has network access to sensitive internal services. Exploitation requires the attacker to send a request to a vulnerable Next.js endpoint that processes dynamic routes or rewrite rules, leading to arbitrary outbound HTTP requests from the server. This can result in data exfiltration, service disruption, or further lateral movement within the network. The vulnerability is particularly critical in cloud deployments where instance metadata services are accessible, potentially allowing credential theft. The flaw stems from improper input sanitization in the Next.js core logic for handling fetch or redirect operations, enabling bypass of security controls. Affected versions include multiple canary and stable releases where the SSRF mitigation was incomplete.
Platform: Vercel Next.js
Version: 14.3.0-16.0.7
Vulnerability: Server-Side Request Forgery
Severity: Critical
Date: 2024-07-09
Prediction: Patched 2024-07-09
What Undercode Say:
Analytics:
Bash commands:
`next –version`
`npm list next`
`npm audit fix`
`curl -I localhost:3000`
Codes:
// Vulnerable pattern in API route
export default function handler(req, res) {
const url = req.query.url; // User-controlled input
fetch(url); // SSRF risk
}
// Secure pattern with validation
const allowedDomains = ['example.com'];
if (!allowedDomains.includes(new URL(url).hostname)) {
return res.status(400).send('Invalid URL');
}
How Exploit:
Attackers send HTTP requests with manipulated parameters directing the Next.js server to fetch internal resources like `http://169.254.169.254/` or database endpoints. Using malicious payloads in query strings or headers, they bypass URL validations to access sensitive systems.
Protection from this CVE:
Update Next.js immediately to version 16.0.7, 15.5.7, or later patched releases. Implement strict input validation for all user-supplied URLs. Use network segmentation and firewalls to restrict outbound server connections. Avoid exposing internal endpoints via rewrite rules.
Impact:
Data confidentiality compromise, internal network exposure, potential denial of service, and unauthorized access to cloud metadata.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
