Executive brief
Next.js is a popular React framework used to build web applications. An improper Content Security Policy (CSP) in the Image Optimization API allows attackers to inject malicious SVG images when the application is configured to load images from certain domains, potentially enabling UI spoofing attacks such as phishing. This vulnerability affects versions 10.0.0 through 12.0.10 and has been patched in version 12.1.0.
Technical details
This vulnerability is a UI misrepresentation flaw (CWE-451) in Next.js's Image Optimization API stemming from improper Content Security Policy enforcement. The vulnerability is triggered when all of the following conditions are met: the application runs Next.js versions 10.0.0 to 12.0.10, the next.config.js file has an images.domains array configured, and the specified image host allows user-supplied SVG uploads. An attacker can inject a malicious SVG image that bypasses CSP restrictions, enabling UI spoofing or phishing attacks. The vulnerability does not affect applications using a non-default loader configuration. The issue is patched in Next.js 12.1.0, and a workaround exists by switching to an alternative loader (e.g., 'imgix' or 'custom') in the next.config.js configuration.
Affected products
- Vercel Next.js 10.0.0 to 12.0.10
Timeline
- 2022-02-17: disclosed
- 2022-02-17: patched: Next.js 12.1.0