Executive brief
Next.js is a popular React web application framework used to build fast, production-ready web applications. An open redirect vulnerability in versions 9.5.0 through 9.5.3 allows attackers to craft malicious links that redirect users to external websites after clicking them, potentially leading to phishing attacks or credential theft. Applications deployed on Vercel's hosting platform or using static exports are not affected.
Technical details
The vulnerability is an open redirect (CWE-601) in Next.js versions 9.5.0 through 9.5.3, triggered during server-side rendering or dynamic routing. The root cause is improper validation of redirect targets, allowing attackers to craft URLs that bypass redirect safety checks. The attack vector is network-based and requires user interaction (clicking a malicious link). An attacker can craft a specially formed URL that redirects authenticated users to attacker-controlled domains, facilitating phishing or social engineering attacks. The vulnerability is patched in Next.js 9.5.4 and later.
Affected products
- Vercel Next.js 9.5.0 through 9.5.3
Timeline
- 2020-10-08: disclosed
- 2020-10-08: patched: Fixed in v9.5.4