Executive brief
Next.js is a popular framework for building web applications with React. Versions 7.0.0 and 7.0.1 contain a cross-site scripting (XSS) vulnerability in the 404 and 500 error pages that allows attackers to inject malicious scripts. An attacker could craft a malicious URL that, when visited by another user, executes arbitrary JavaScript code in their browser, potentially stealing session tokens or credentials.
Technical details
Next.js 7.0.0 and 7.0.1 fail to properly sanitize user input in the /_error page handler for 404 and 500 errors (CWE-79: Improper Neutralization of Input During Web Page Generation). The vulnerability can be exploited via network attack without authentication, but requires user interaction (the victim must visit a malicious URL). An attacker can inject arbitrary JavaScript code that executes in the victim's browser within the application's security scope. The vulnerability was fixed in version 7.0.2.
Affected products
- Vercel Next.js 7.0.0 to 7.0.1
Timeline
- 2018-10-15: disclosed
- 2018: patched: Fixed in version 7.0.2