ghosind / biotools Goto Github PK

Vulnerable Library - next-14.1.0.tgz

Library home page: https://registry.npmjs.org/next/-/next-14.1.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/next/package.json

CVE-2024-34351

Vulnerable Library - next-14.1.0.tgz

Library home page: https://registry.npmjs.org/next/-/next-14.1.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/next/package.json

Dependency Hierarchy:

• ❌ next-14.1.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Next.js is a React framework that can provide building blocks to create web applications. A Server-Side Request Forgery (SSRF) vulnerability was identified in Next.js Server Actions. If the Host header is modified, and the below conditions are also met, an attacker may be able to make requests that appear to be originating from the Next.js application server itself. The required conditions are 1) Next.js is running in a self-hosted manner; 2) the Next.js application makes use of Server Actions; and 3) the Server Action performs a redirect to a relative path which starts with a /. This vulnerability was fixed in Next.js 14.1.1.

Publish Date: 2024-05-09

URL: CVE-2024-34351

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: GHSA-77r5-gw3j-2mpf

Release Date: 2024-05-09

Fix Resolution: 14.1.1-canary.0

Step up your Open Source Security Game with Mend here