Описание
Next.js is a React framework for building full-stack web applications. In versions 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales can bypass middleware/proxy based authentication. This issue has been fixed in version 16.2.11.
A flaw was found in Next.js, a React framework. A remote attacker can bypass authentication in Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales by sending crafted requests. This vulnerability allows for unauthorized access, leading to a high impact on confidentiality through information disclosure.
Отчет
Important: A flaw in Next.js applications, when specifically configured with App Router, Turbopack, and a single internationalization locale entry, allows for authentication bypass. This could enable unauthorized access to web applications utilizing such a configuration within Red Hat products.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Cryostat 4 | i18next | Not affected | ||
| Red Hat 3scale API Management Platform 2 | 3scale-amp2/backend-rhel8 | Not affected | ||
| Red Hat 3scale API Management Platform 2 | 3scale-amp2/system-rhel7 | Not affected | ||
| Red Hat AMQ Broker 7 | i18next | Not affected | ||
| Red Hat build of Apache Camel 4 for Quarkus 3 | quarkus-websockets-next-spi | Not affected | ||
| Red Hat build of Apache Camel for Spring Boot 4 | i18next | Not affected | ||
| Red Hat build of Apache Camel - HawtIO 4 | quarkus-websockets-next-spi | Not affected | ||
| Red Hat build of Apicurio Registry 3 | quarkus-websockets-next-spi | Not affected | ||
| Red Hat Build of Keycloak | quarkus-websockets-next-spi | Not affected | ||
| Red Hat build of Quarkus | quarkus-websockets-next-deployment | Not affected |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
8.2 High
CVSS3
Связанные уязвимости
Next.js is a React framework for building full-stack web applications. In versions 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales can bypass middleware/proxy based authentication. This issue has been fixed in version 16.2.11.
Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale
EPSS
8.2 High
CVSS3