Ce mail provient de l'extérieur, restons vigilants

=====================================================================

                            CERT-Renater

                Note d'Information No. 2025/VULN163

_____________________________________________________________________

DATE                : 21/03/2025

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Next.js versions prior to
                               14.2.25, 15.2.3.

=====================================================================
https://github.com/vercel/next.js/security/advisories/GHSA-f82v-jwr5-mffw
_____________________________________________________________________

Authorization Bypass in Next.js Middleware
Critical
jackwilson323 published GHSA-f82v-jwr5-mffw Mar 21, 2025

Package
next (npm)

Affected versions
> 11.1.4 <=13.5.6
>14.0 <14.2.25
>15.0 <15.2.3

Patched versions
None
14.2.25
15.2.3


Description

Impact

It is possible to bypass authorization checks within a Next.js
application, if the authorization check occurs in middleware.


Patches

    For Next.js 15.x, this issue is fixed in 15.2.3
    For Next.js 14.x, this issue is fixed in 14.2.25
    For Next.js versions 11.1.4 thru 13.5.6 we recommend
consulting the below workaround.


Workaround

If patching to a safe version is infeasible, we recommend that
you prevent external user requests which contain the
x-middleware-subrequest header from reaching your Next.js
application.


Credits

    Allam Rachid (zhero;)
    Allam Yasser (inzo_)


Severity
Critical
9.1/ 10

CVSS v3 base metrics
Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CVE ID
CVE-2025-29927

Weaknesses
CWE-285

Credits

    @cold-try cold-try Reporter


=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================