Executive brief
Next.js is a popular React framework used to build web applications. Versions prior to 5.1.0 contain a vulnerability in the /path route handler that fails to sanitize user input before passing it to a require() call, allowing unauthenticated attackers to execute arbitrary JavaScript code on the server. This could lead to complete server compromise, data theft, or service disruption.
Technical details
The vulnerability exists in the /path route handler of next.js versions prior to 5.1.0, which is classified as improper input validation (CWE-20). The root cause is that user-supplied input is passed unsanitized directly to a require() call, enabling arbitrary code execution. The attack vector is network-based; an attacker can craft a malicious request to the /path endpoint without authentication to trigger the vulnerability. By manipulating the path parameter, an attacker can load and execute arbitrary JavaScript modules on the server, resulting in remote code execution with the privileges of the Node.js process. The vulnerability was fixed in version 5.1.0; affected users should upgrade immediately.
Affected products
- Vercel next 0.9.9 through 5.0.x
Timeline
- 2020-09-04: disclosed
- 2020-09-04: patched: Fixed in version 5.1.0