vercel Next.js up to 13.5.6/14.2.9 authorization

Summaryinfo

A vulnerability was found in vercel Next.js up to 13.5.6/14.2.9. It has been declared as critical. This issue affects some unknown processing. Executing a manipulation can lead to authorization. The identification of this vulnerability is CVE-2024-46982. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in vercel Next.js up to 13.5.6/14.2.9. It has been declared as critical. This vulnerability affects some unknown processing. The manipulation with an unknown input leads to a authorization vulnerability. The CWE definition for the vulnerability is CWE-639. The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. As an impact it is known to affect availability. CVE summarizes:

Next.js is a React framework for building full-stack web applications. By sending a crafted HTTP request, it is possible to poison the cache of a non-dynamic server-side rendered route in the pages router (this does not affect the app router). When this crafted request is sent it could coerce Next.js to cache a route that is meant to not be cached and send a `Cache-Control: s-maxage=1, stale-while-revalidate` header which some upstream CDNs may cache as well. To be potentially affected all of the following must apply: 1. Next.js between 13.5.1 and 14.2.9, 2. Using pages router, & 3. Using non-dynamic server-side rendered routes e.g. `pages/dashboard.tsx` not `pages/blog/[slug].tsx`. This vulnerability was resolved in Next.js v13.5.7, v14.2.10, and later. We recommend upgrading regardless of whether you can reproduce the issue or not. There are no official or recommended workarounds for this issue, we recommend that users patch to a safe version.

The advisory is shared for download at github.com. This vulnerability was named CVE-2024-46982 since 09/16/2024. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are neither technical details nor an exploit publicly available.

Upgrading to version 13.5.7 or 14.2.10 eliminates this vulnerability. Applying the patch 7ed7f125e07ef0517a331009ed7e32691ba403d3 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• JavaScript Library

Vendor

• vercel

Name

• Next.js

Version

• 13.5.0
• 13.5.1
• 13.5.2
• 13.5.3
• 13.5.4
• 13.5.5
• 13.5.6
• 14.2.0
• 14.2.1
• 14.2.2
• 14.2.3
• 14.2.4
• 14.2.5
• 14.2.6
• 14.2.7
• 14.2.8
• 14.2.9

License

• open-source

Website

• Product: https://github.com/vercel/next.js/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion