Next.js is a React framework that can provide building blocks to create web applications. A Server-Side Request Forgery (SSRF) vulnerability was identified in Next.js Server Actions. If the `Host` header is modified, and the below conditions are also met, an attacker may be able to make requests that appear to be originating from the Next.js application server itself. The required conditions are 1) Next.js is running in a self-hosted manner; 2) the Next.js application makes use of Server Actions; and 3) the Server Action performs a redirect to a relative path which starts with a `/`. This vulnerability was fixed in Next.js `14.1.1`.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Next.js is a React framework that can provide building blocks to create web applications. A Server-Side
    Request Forgery (SSRF) vulnerability was identified in Next.js Server Actions. If the `Host` header is
    modified, and the below conditions are also met, an attacker may be able to make requests that appear to
    be originating from the Next.js application server itself. The required conditions are 1) Next.js is
    running in a self-hosted manner; 2) the Next.js application makes use of Server Actions; and 3) the Server
    Action performs a redirect to a relative path which starts with a `/`. This vulnerability was fixed in
    Next.js `14.1.1`. (CVE-2024-34351)

Next.js versions from 13.4 (included) before 14.1.1 suffer from a Server-Side Request Forgery (SSRF) when using Server Actions performing a redirection to a relative path starting with '/'. By leveraging this vulnerability, a remote and unauthenticated attacker can forge an arbitrary 'Host' header and make the vulnerable instance perform arbitrary HTTP requests.

ID	Name	Product	Family	Severity
414669	SCA: security update for next (GHSA-fr5h-rqp8-mj6g)	Tenable Cloud Security	SCA Checks	high
414669	SCA: security update for next (GHSA-fr5h-rqp8-mj6g)	Tenable Self-Hosted Container Security	SCA Checks	high
114431	Next.js < 14.1.1 Server Actions Server-Side Request Forgery	Web App Scanning	Component Vulnerability	high

Detections

Analytics

CVE-2024-34351

high

Tenable Plugins

high

high

high