VDB
CVE-2024-34351
CVE-2024-34351
PUBLISHED
KEV
CVSS 7.5 HIGH
Next.js is a React framework that can provide building blocks to create web applications. A Server-Side Request Forgery (SSRF) vulnerability was identified in Next.js Server Actions. If the `Host` header is modified, and the below conditions are also met, an attacker may be able to make requests that appear to be originating from the Next.js application server itself. The required conditions are 1) Next.js is running in a self-hosted manner; 2) the Next.js application makes use of Server Actions; and 3) the Server Action performs a redirect to a relative path which starts with a `/`. This vulnerability was fixed in Next.js `14.1.1`.
EPSS 5.45% · 92.2th percentile
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score
5.45%
92.2th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| vercel | next.js | 13.4.0, 13.4.0, * |
| vercel | next.js | 13.4.0 |
| npm | next | 13.4.0, 13.4.0 |
Timeline
- Jan 21, 1970 Security Advisory
- Apr 27, 2022 CrowdSec Sighting
- May 4, 2022 CrowdSec Sighting
- May 6, 2022 CrowdSec Sighting
- Jun 3, 2022 CrowdSec Sighting
- Jun 19, 2022 CrowdSec Sighting
- Jul 30, 2022 CrowdSec Sighting
- Sep 7, 2022 CrowdSec Sighting
- Sep 17, 2022 CrowdSec Sighting
- Sep 26, 2022 CrowdSec Sighting
- Dec 18, 2022 CrowdSec Sighting
- Jan 2, 2023 CrowdSec Sighting
References
- Nuclei Template exploit
- https://github.com/vercel/next.js/security/advisories/GHSA-fr5h-rqp8-mj6g url
- https://github.com/vercel/next.js/commit/8f7a6ca7d21a97bc9f7a1bbe10427b5ad74b9085 url
- https://github.com/vercel/next.js/pull/62561 url
- https://www.ibm.com/support/pages/node/7176657 advisory
- https://www.ibm.com/support/pages/node/7176660 advisory
- https://www.ibm.com/support/pages/node/7176201 advisory
- https://www.ibm.com/support/pages/node/7176392 advisory
- https://www.ibm.com/support/pages/node/7176386 advisory
- https://www.ibm.com/support/pages/node/7176205 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-34351 advisory
- https://github.com/vercel/next.js package
- https://www.ibm.com/support/pages/node/7157924 advisory
- https://www.ibm.com/support/pages/node/7157750 advisory
- https://www.ibm.com/support/pages/node/7157927 advisory
- https://www.ibm.com/support/pages/node/7158042 advisory
- https://www.ibm.com/support/pages/node/7157662 advisory
- https://www.ibm.com/support/pages/node/7157753 advisory
- https://www.ibm.com/support/pages/node/7176642 advisory
- https://www.ibm.com/support/pages/node/7176391 advisory
…and 5 more