Описание
Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, Image Optimization can follow attacker-controlled DNS resolution for a remote URL that matches images.remotePatterns, allowing the optimized image fetch to reach private IP addresses after the URL passes the allow-list check. Applications without images.remotePatterns are not affected. Administrators unable to upgrade should audit allow-listed hosts and avoid entries whose DNS records are not trusted. This issue is fixed in version 16.3.8.
A flaw was found in Next.js Image Optimization, which can lead to information disclosure via Server-Side Request Forgery (SSRF). In configurations where remote image optimization is enabled with host allowlists, the application can follow attacker-controlled Domain Name System (DNS) resolution after initial URL validation checks. A remote attacker can exploit this flaw to bypass network restrictions and force the server to query private IP addresses, exposing sensitive internal services.
Отчет
This vulnerability is rated with a Low severity because exploitation requires a specific, non-default configuration where the application explicitly permits remote domains whose DNS records can be controlled or manipulated by an external adversary. In typical Red Hat deployments, Next.js is not exposed with arbitrary remote image patterns permitted, which significantly restricts the attack surface. Furthermore, successful abuse is limited to internal network request forgery with read-only retrieval of image responses, without direct code execution or write privileges.
Меры по смягчению последствий
Audit and restrict the images.remotePatterns configuration in next.config.js to eliminate untrusted hostnames, or remove the remotePatterns configuration entirely if external image fetching is not required. Additionally, egress network filtering can be enforced to prevent application containers or hosts from reaching private network ranges.
Caveats: Disabling or removing remote image entries will prevent external image optimization.
Warning: Modifying application configuration requires restarting the affected container or service, which will temporarily interrupt service availability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | firefox | Fix deferred | ||
| Red Hat Enterprise Linux 10 | thunderbird | Fix deferred | ||
| Red Hat Enterprise Linux 7 | firefox | Fix deferred | ||
| Red Hat Enterprise Linux 8 | firefox | Fix deferred | ||
| Red Hat Enterprise Linux 8 | thunderbird | Fix deferred | ||
| Red Hat Enterprise Linux 9 | firefox | Fix deferred | ||
| Red Hat Enterprise Linux 9 | thunderbird | Fix deferred | ||
| Red Hat Enterprise Linux AI (RHEL AI) 3 | rhelai3/bootc-cuda-rhel9 | Fix deferred | ||
| Red Hat Enterprise Linux AI (RHEL AI) 3 | rhelai3/bootc-gaudi-rhel9 | Fix deferred | ||
| Red Hat Enterprise Linux AI (RHEL AI) 3 | rhelai3/bootc-rocm-rhel9 | Fix deferred |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
3.7 Low
CVSS3
Связанные уязвимости
Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, Image Optimization can follow attacker-controlled DNS resolution for a remote URL that matches images.remotePatterns, allowing the optimized image fetch to reach private IP addresses after the URL passes the allow-list check. Applications without images.remotePatterns are not affected. Administrators unable to upgrade should audit allow-listed hosts and avoid entries whose DNS records are not trusted. This issue is fixed in version 16.3.8.
Next.js has Server-Side Request Forgery in Image Optimization
EPSS
3.7 Low
CVSS3