Vulnerability · Published May 9, 2024 · Assigned by GitHub_M

CVE-2024-34351Next.js Server-Side Request Forgery in Server Actions

High 7.5

In plain English

A high-severity server-side request forgery in next.js from vercel. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 5.5% (higher than 93% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)5.5%top 7.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling2Nuclei, Public PoC

Official description

Next.js is a React framework that can provide building blocks to create web applications. A Server-Side Request Forgery (SSRF) vulnerability was identified in Next.js Server Actions. If the `Host` header is modified, and the below conditions are also met, an attacker may be able to make requests that appear to be originating from the Next.js application server itself. The required conditions are 1) Next.js is running in a self-hosted manner; 2) the Next.js application makes use of Server Actions; and 3) the Server Action performs a redirect to a relative path which starts with a `/`. This vulnerability was fixed in Next.js `14.1.1`.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	next	14.1.1	GHSA-fr5h-rqp8-mj6g

Affected products (as reported)

Vendor	Product	Versions
vercel	next.js	>= 13.4.0, < 14.1.1

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/vercel/next.js/security/advisories/GHSA-fr5h-rqp8-mj6g x_refsource_CONFIRM
https://github.com/vercel/next.js/pull/62561 x_refsource_MISC
https://github.com/vercel/next.js/commit/8f7a6ca7d21a97bc9f7a1bbe10427b5ad74b9085 x_refsource_MISC