Add active scan script for CVE-2025-29927 (Next.js middleware authentication bypass) - #525
Open
comradezephyr wants to merge 1 commit into
Open
comradezephyr wants to merge 1 commit into
comradezephyr wants to merge 1 commit into
Conversation
…ication bypass) This script implements an active scan rule for CVE-2025-29927, targeting Next.js middleware authentication bypass vulnerabilities. It sends requests with specific headers to check if the middleware can be bypassed, raising alerts when vulnerabilities are confirmed. Signed-off-by: Zephyr <149247976+comradezephyr@users.noreply.github.com>
Author
|
Note: I have not added a CHANGELOG.md entry yet. Happy to add one under : ) |
Member
|
New Issues (12 out of 12)Checkmarx found the following issues in this Pull RequestSeverity: 2
Use @Checkmarx to take action directly from this PR:
Try it: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds an active scan script that detects CVE-2025-29927, a critical (CVSS 9.1)
authorization bypass in Next.js. Next.js uses the
x-middleware-subrequestrequest header to identify its own internal subrequests and, in vulnerable
versions, trusts it without verifying that the request originated internally.
Supplying the header causes the application's middleware to be skipped
entirely, bypassing any authentication, authorization or redirect logic
implemented there.
Fixed in Next.js 12.3.5, 13.5.9, 14.2.25 and 15.2.3.
What the script does
GETnodes, and only continues when the baseline response looksgated by middleware (301/302/303/307/308, 401 or 403). Resources returning
200 are skipped, since public and protected responses cannot be
distinguished.
x-middleware-subrequestvalue(
middlewarex5,src/middlewarex5,middleware,src/middleware,pages/_middleware). The x5 values are needed for Next.js 13.2 and later,where the middleware module name must appear five times
(MAX_RECURSION_DEPTH).
from the baseline and does not look like a login page. 5xx responses are
ignored.
present, downgrading to Low confidence when they are not (they are trivial
to hide), so weaker findings do not pollute high-confidence reports.
getMetadata()/ScanRuleMetadata.fromYamlpattern alreadyused by
active/SSTI.jsandactive/OpenModelContextProtocolServer.js.Metadata:
id: 100046, CWE-287 (Improper Authentication), WASC-1,OWASP Top 10 2021 A01 / 2017 A02 alert tags,
status: alpha.How it was tested
node --checkon the script: pass./gradlew spotlessCheck(same check CI runs): passVerifyScripts(parses every script with GraalJS):182 tests, 182 successful, 0 failed, including
TEST-DONE active\CVE202529927.js -> SUCCESSFUL(vulnerable, patched, SPA shell, SSO gateway, public page, 401 gate,
same-size response, 5xx, hidden Next.js headers, POST skip, de-duplication,
scan()no-op, metadata): 43 checks, 0 failedgetMetadata()YAML validated with SnakeYAML (the parser ZAP uses):all 14 keys and references parsed correctly
I have not yet run a live end-to-end scan inside ZAP against a real Next.js
deployment; the verification above is at the script level. Happy to run it
against a lab target and report results if that would help.
References
Notes
This is my first contribution to ZAP. Feedback on style and conventions is
welcome. I chose
100046as the scan rule ID after checking the IDs alreadyused by the community scripts (highest existing is
100045); happy to changeit if another is preferred.
While preparing this I noticed that
./gradlew checkfails on Windowsbecause
VerifyScripts.readFiles()filters the classpath withendsWith("/scripts")while Gradle passes a path with backslashes onWindows. It fails before reading any script file. CI runs on Linux so it is
unaffected. I did not touch that file; mentioning it in case it is worth a
separate issue.