## https://sploitus.com/exploit?id=623D02DA-B58C-5BAF-9206-9F9232C5F082
# Next.js CVE-2025-29927
This repository contains a proof of concept for CVE-2025-29927 vulnerability in Next.js, where the internal header ```x-middleware-subrequest``` can be exploited to bypass middleware checks such as authentication.
# Affected Versions
- Next.js 15.x < 15.2.3
- Next.js 14.x < 14.2.25
- Next.js 13.x < 13.5.9
## Installation
> ๐งช This project was tested with **Next.js v13.4.19**.
1. Clone the repository:
```bash
git clone https://github.com/goncalocsousa1/CVE-2025-29927.git
cd CVE-2025-29927
```
2. Install dependencies:
```bash
npm install
```
## Running the Application
1. Start the development server:
```bash
npm run dev
```
2. Access the application in your browser:
```
http://localhost:3000
```
## How the website works
The application demonstrates a simple authentication system with a protected route that can be bypassed using the CVE-2025-29927 vulnerability. Here's how it works:
1. **Home Page (`/`)**
- Displays a welcome message and a login button
- When clicked, the login button sets a fake authentication cookie (`auth-token`)
- After "logging in", users are redirected to the protected page
2. **Protected Page (`/protected`)**
- Contains sensitive information that should only be accessible to authenticated users
- Protected by middleware that checks for the presence of the `auth-token` cookie
- Normally, unauthenticated users would be redirected to the home page
3. **Middleware Protection**
- The middleware checks if the user has an `auth-token` cookie
- If not authenticated and trying to access `/protected/*` routes, redirects to home page
- This protection can be bypassed using the vulnerability
4. **Vulnerability Demonstration**
- The application showcases how the `x-middleware-subrequest` header can be exploited
- This allows attackers to bypass the middleware authentication check
- Even without a valid `auth-token` cookie, attackers can access protected routes
## How to Exploit
This application includes a protected route at ```/protected``` that normally requires authentication. However, by using the header ```x-middleware-subrequest: middleware``` in a request like ```curl -H "x-middleware-subrequest: middleware" http://localhost:3000/protected```, you can bypass the authentication check.
You can also reproduce this behavior using [Burp Suite](https://portswigger.net/burp/communitydownload) by intercepting the request and manually adding the header.
To try this with Burp Suite, open the ```Proxy``` tab and go to the ```Intercept``` sub-tab. Make sure ```Intercept is On```, then click on **Open Browser** and navigate to the protected route: ```http://localhost:3000/protected```
Burp Suite will capture the request to the protected route. From there, add the following header: `x-middleware-subrequest: middleware` (*highlighted in the screenshot above*). Finally, forward the request and access the protected route.
# Solution
Update to one of the following patched versions:
- Next.js 15.2.3 or higher
- Next.js 14.2.25 or higher
- Next.js 13.5.9 or higher
# Sources
- https://vercel.com/blog/postmortem-on-next-js-middleware-bypass
- https://nvd.nist.gov/vuln/detail/CVE-2025-29927