Share 
## https://sploitus.com/exploit?id=9627DB77-BBC4-5097-A6D2-B15924B1C522
# Next.js Middleware Bypass (CVE-2025-29927) Proof of Concept

This repository contains a **proof of concept (POC)** for **CVE-2025-29927**, a critical vulnerability in **Next.js** that allows attackers to bypass authorization checks implemented in middleware.

## ๐Ÿ“‹ Table of Contents
1. [Running the POC Application](#running-the-poc-application)
2. [Using the Exploit Script](#using-the-exploit-script)
3. [How to Fix the Vulnerability](#how-to-fix-the-vulnerability)
4. [Vulnerability Details](#vulnerability-details)

---

## Running the POC Application

This Next.js application demonstrates the vulnerability with a protected dashboard route.

### Setup Instructions

1. Clone the repository
2. Install and run:
    ```bash
    npm install
    npm run build
    npm run start
    ```
3. Access http://localhost:3000 in your browser
4. Try accessing the protected dashboard at /dashboard

---

## Using the Exploit Script

The exploit script can test any Next.js application for this vulnerability.

### Usage
```bash
npm run exploit <target-url>
```

### Example
```bash
npm run exploit http://localhost:3000/dashboard
```

### How it Works
The exploit tool:
1. Takes a target URL as input
2. Makes a normal request to check if the route is protected
3. Attempts to bypass middleware using the `x-middleware-subrequest` header
4. Compares responses to determine vulnerability

### Sample Output
```bash
=== Next.js CVE-2025-29927 Middleware Bypass Tester ===
Target: http://localhost:3000/dashboard

Testing vulnerability...
Normal request status: 307
Bypass request status: 200

โš ๏ธ  VULNERABLE
The route is protected but accessible with the bypass header
```

---

## How to Fix the Vulnerability

A fix implementation is available in the [how-to-fix branch](https://github.com/kOaDT/poc-cve-2025-29927/tree/how-to-fix).

### Quick Fixes
1. **Update Next.js Version** (Recommended)
   - Update to one of these patched versions:
     - Next.js 15.x โ†’ **15.2.3**
     - Next.js 14.x โ†’ **14.2.25**
     - Next.js 13.x โ†’ **13.5.9**
     - Next.js 12.x โ†’ **12.3.5**

2. **Implement Secondary Validation**
   - Add authentication checks in your API routes/pages
   - Don't rely solely on middleware for security

### Sample Output
```bash
=== Next.js CVE-2025-29927 Middleware Bypass Tester ===

Target: http://localhost:3000/dashboard

Testing vulnerability...
Making request without bypass header...
Making request with bypass header...
Normal request status: 307
Bypass request status: 307

โœ“ NOT VULNERABLE - Protected Route
The route is protected and the bypass attempt was unsuccessful
Normal request redirected to: /
Bypass request redirected to: /
```

---

## Vulnerability Details

### CVE Information
- **CVE ID**: CVE-2025-29927
- **Affected Versions**:
  - 13.0.0 - 13.5.8
  - 14.0.0 - 14.2.24
  - 15.0.0 - 15.2.2
  - 11.1.4 - 12.3.4

### Description
Next.js uses an internal header `x-middleware-subrequest` to prevent recursive requests. This vulnerability allows attackers to **bypass middleware security checks** by manipulating this header.

### Impact
- Unauthorized access to protected routes
- Bypass of authentication checks
- Circumvention of security middleware

### Affected Environments
- Self-hosted Next.js applications using Middleware

### References
- [Next.js Security Advisory](https://nextjs.org/blog/cve-2025-29927)
- [GitHub Security Advisory](https://github.com/advisories/GHSA-f82v-jwr5-mffw)

---

## Disclaimer

This tool is provided for educational and testing purposes only. Only use this tool on systems you own or have explicit permission to test.