Next.js authorization bypass vulnerability
अनुवाद हो रहा है…प्लेटफ़ॉर्म
nodejs
घटक
next
में ठीक किया गया
9.5.6
14.2.15
CVE-2024-51479 affects Next.js applications that rely on pathname-based authorization within middleware. This vulnerability allows attackers to bypass these authorization checks, potentially leading to unauthorized access to protected resources. The issue is present in versions prior to Next.js 14.2.15, but has been automatically mitigated for applications hosted on Vercel regardless of Next.js version.
प्रभाव और हमले की स्थितियाँअनुवाद हो रहा है…
The core impact of CVE-2024-51479 lies in the ability to circumvent authorization logic. If a Next.js application uses middleware to restrict access to specific routes based on the pathname, an attacker can craft requests that bypass this check. This could allow them to access sensitive data, execute unauthorized actions, or even compromise the entire application. The blast radius depends heavily on the application's architecture and the sensitivity of the resources protected by the middleware. A successful exploit could lead to data breaches, privilege escalation, and denial of service.
शोषण संदर्भअनुवाद हो रहा है…
CVE-2024-51479 was published on December 17, 2024. There is currently no indication of active exploitation in the wild. The vulnerability was responsibly disclosed by tyage (GMO CyberSecurity by IERAE). No KEV or EPSS score is currently available. Public proof-of-concept exploits are not widely available, but the potential for exploitation exists if authorization logic is improperly implemented.
खतरा खुफिया
एक्सप्लॉइट स्थिति
EPSS
66.73% (99% शतमक)
CISA SSVC
CVSS वेक्टर
इन मेट्रिक्स का क्या मतलब है?
- Attack Vector
- नेटवर्क — इंटरनेट के माध्यम से दूरस्थ रूप से शोषण योग्य। कोई भौतिक या स्थानीय पहुंच आवश्यक नहीं।
- Attack Complexity
- निम्न — कोई विशेष शर्त नहीं। विश्वसनीय रूप से शोषण योग्य।
- Privileges Required
- कोई नहीं — बिना प्रमाणीकरण के शोषण योग्य।
- User Interaction
- कोई नहीं — स्वचालित और मूक हमला। पीड़ित कुछ नहीं करता।
- Scope
- अपरिवर्तित — प्रभाव केवल कमज़ोर घटक तक सीमित।
- Confidentiality
- उच्च — पूर्ण गोपनीयता हानि। हमलावर सभी डेटा पढ़ सकता है।
- Integrity
- कोई नहीं — अखंडता पर कोई प्रभाव नहीं।
- Availability
- कोई नहीं — उपलब्धता पर कोई प्रभाव नहीं।
प्रभावित सॉफ्टवेयर
पैकेज जानकारी
- अंतिम अपडेट
- 16.2.6हाल ही में
कमजोरी वर्गीकरण (CWE)
समयरेखा
- आरक्षित
- प्रकाशित
- संशोधित
- EPSS अद्यतन
शमन और वर्कअराउंडअनुवाद हो रहा है…
The primary mitigation for CVE-2024-51479 is to upgrade to Next.js version 14.2.15 or later. For applications hosted on Vercel, the vulnerability is automatically mitigated, so no action is required. Since official workarounds are not available, careful review of authorization logic is crucial. Ensure that authorization checks are robust and not solely reliant on pathname-based restrictions. Consider implementing multi-factor authentication and other security best practices to further protect your application.
कैसे ठीक करेंअनुवाद हो रहा है…
Actualice Next.js a la versión 14.2.15 o superior. Si su aplicación Next.js está alojada en Vercel, la vulnerabilidad ya ha sido mitigada automáticamente. De lo contrario, actualice la versión de Next.js lo antes posible.
CVE सुरक्षा न्यूज़लेटर
भेद्यता विश्लेषण और गंभीर अलर्ट सीधे आपके ईमेल में।
अक्सर पूछे जाने वाले सवालअनुवाद हो रहा है…
What is CVE-2024-51479 — Path Traversal Bypass in Next.js?
CVE-2024-51479 is a vulnerability in Next.js where attackers can bypass pathname-based authorization in middleware, potentially gaining unauthorized access to protected resources. It's rated HIGH severity (CVSS 7.5).
Am I affected by CVE-2024-51479 in Next.js?
You are affected if you are using Next.js versions prior to 14.2.15 and your application relies on pathname-based authorization in middleware. Applications hosted on Vercel are automatically mitigated regardless of version.
How do I fix CVE-2024-51479 in Next.js?
Upgrade to Next.js version 14.2.15 or later. If hosted on Vercel, the vulnerability is automatically mitigated. Review and strengthen your authorization logic.
Is CVE-2024-51479 being actively exploited?
There is currently no indication of active exploitation in the wild, but the potential for exploitation exists.
Where can I find the official Next.js advisory for CVE-2024-51479?
Refer to the Next.js security advisory for detailed information: [https://github.com/vercel/next.js/security/advisories/GHSA-9x44-x444-x444](https://github.com/vercel/next.js/security/advisories/GHSA-9x44-x444-x444)
क्या आपका प्रोजेक्ट प्रभावित है?
अपनी डिपेंडेंसी फ़ाइल अपलोड करें और तुरंत जानें कि यह CVE और अन्य आपको प्रभावित करती हैं या नहीं।