🚨Alert🚨CVE-2024-34351:Next.js Server-Side Request Forgery in Server Actions
🔥PoC: https://www.assetnote.io/resources/research/digging-for-ssrf-in-nextjs-apps#/
⚠A SSRF vulnerability was identified in Next.js Server Actions by security researchers at Assetnote. If the Host header is modified, and the below conditions are also met, an attacker may be able to make requests that appear to be originating from the Next.js application server itself.
📊3.1M+ Services are found on hunter.how
🔗Hunter Link: https://hunter.how/list?searchValue=product.name%3D%22Next.js%22
📰Refer: https://github.com/advisories/GHSA-fr5h-rqp8-mj6g
Hunter:/product.name="Next.js"
FOFA:app="Next.js"
SHODAN:http.component:"Next.js"
#NextJS #SSRF #Vulnerability
🔥PoC: https://www.assetnote.io/resources/research/digging-for-ssrf-in-nextjs-apps#/
⚠A SSRF vulnerability was identified in Next.js Server Actions by security researchers at Assetnote. If the Host header is modified, and the below conditions are also met, an attacker may be able to make requests that appear to be originating from the Next.js application server itself.
📊3.1M+ Services are found on hunter.how
🔗Hunter Link: https://hunter.how/list?searchValue=product.name%3D%22Next.js%22
📰Refer: https://github.com/advisories/GHSA-fr5h-rqp8-mj6g
Hunter:/product.name="Next.js"
FOFA:app="Next.js"
SHODAN:http.component:"Next.js"
#NextJS #SSRF #Vulnerability
www.assetnote.io
Digging for SSRF in NextJS apps
At Assetnote, we encounter sites running NextJS extremely often; in this blog post we will detail some common misconfigurations we find in NextJS websites, along with a vulnerability we found in the framework.