AIKIDO-2024-10173
next is vulnerable to Server-Side Request Forgery (SSRF)
60
Medium Risk
This Affects:
nextTL;DR
Affected versions of the next package are vulnerable to server-side request forgery (SSRF) due to a flaw in the image optimization functionality. The Image Optimization API checks if the given image URL is relative by verifying if url.startsWith('/'). This allows protocol-relative URLs (e.g., //example.com) to bypass the check and be treated as relative. As a result, these URLs skip validation against remote patterns and are processed as relative URLs, potentially exposing the system to SSRF attacks.
Who does this affect?
You are affected if you are using a vulnerable version of next and if you are using it in combination with https://github.com/cloudflare/next-on-pages.
Background info
next is vulnerable to Server-Side Request Forgery (SSRF) in versions 12.1.0 - 14.2.4.
How to fix this
Upgrade the next library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant