Next.js versions from 13.4 (included) before 14.1.1 suffer from a Server-Side Request Forgery (SSRF) when using Server Actions performing a redirection to a relative path starting with '/'. By leveraging this vulnerability, a remote and unauthenticated attacker can forge an arbitrary 'Host' header and make the vulnerable instance perform arbitrary HTTP requests.

Next.js 13.4 (含) 至 14.1.1 版本使用 Server Actions 執行重新導向至以「/」開頭的相對路徑時，會產生伺服器端要求偽造 (SSRF) 弱點。未經驗證的遠端攻擊者可利用此弱點來偽造任意「Host」標頭，並使包含弱點的執行個體執行任意 HTTP 要求。

Next.js 13.4（含）至 14.1.1 版本在使用 Server Actions 执行重定向到以“/”开头的相对路径时，会受到服务器端请求伪造 (SSRF) 漏洞的影响。未经身份验证的远程攻击者可利用此漏洞来伪造任意“Host”标头，并使易受攻击的实例执行任意 HTTP 请求。

14.1.1 より前、13.4 以降の Next.js のバージョンは、「/」で始まる相対パスへのリダイレクトを実行するサーバーアクションを使用する際に、サーバーサイドリクエスト偽造 (SSRF) の影響を受けます。この脆弱性を悪用し、認証されていないリモートの攻撃者が任意の「Host」ヘッダーを偽造し、脆弱なインスタンスに任意の HTTP リクエストを実行させる可能性があります。

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Next.js is a React framework that can provide building blocks to create web applications. A Server-Side
    Request Forgery (SSRF) vulnerability was identified in Next.js Server Actions. If the `Host` header is
    modified, and the below conditions are also met, an attacker may be able to make requests that appear to
    be originating from the Next.js application server itself. The required conditions are 1) Next.js is
    running in a self-hosted manner; 2) the Next.js application makes use of Server Actions; and 3) the Server
    Action performs a redirect to a relative path which starts with a `/`. This vulnerability was fixed in
    Next.js `14.1.1`. (CVE-2024-34351)

ID	Name	Product	Family	Published	Updated	Severity
114431	Next.js < 14.1.1 Server Actions Server-Side Request Forgery	Web App Scanning	Component Vulnerability	9/17/2024	9/17/2024	high
114431	Next.js < 14.1.1 Server Actions 伺服器端要求偽造弱點	Web App Scanning	Component Vulnerability	9/17/2024	9/17/2024	high
114431	Next.js < 14.1.1 Server Actions 的服务器端请求伪造漏洞	Web App Scanning	Component Vulnerability	9/17/2024	9/17/2024	high
114431	Next.js < 14.1.1 サーバーアクションのサーバーサイドリクエスト偽造	Web App Scanning	Component Vulnerability	9/17/2024	9/17/2024	high
414669	SCA: security update for next (GHSA-fr5h-rqp8-mj6g)	Tenable Self-Hosted Container Security	SCA Checks	1/23/2025	7/2/2026	high
414669	SCA: security update for next (GHSA-fr5h-rqp8-mj6g)	Tenable Cloud Security	SCA Checks	1/23/2025	7/2/2026	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high