Next.js Authorization Bypass Vulnerability in Middleware

A vulnerability exists in Next.js, a React framework for full-stack web applications, allowing authorization checks to be bypassed in middleware. This issue affects Next.js versions 1.11.4 prior to 12.3.5, as well as versions 13.5.9, 14.2.25, and 15.2.3. The vulnerability arises because the 'x-middleware-subrequest' header, used to prevent recursive requests, can be exploited to skip critical checks like authorization cookie validation, potentially leading to unauthorized access.

Impact

Exploitation of this vulnerability can result in unauthorized access to routes by bypassing middleware authorization checks, which could allow sensitive information disclosure or unauthorized data modification.

Reproduction

To reproduce this vulnerability, deploy a self-hosted Next.js application using 'next start' with 'output: standalone'. Ensure that the application relies on middleware for authorization or security checks. When a request is made with the 'x-middleware-subrequest' header, the middleware authorization checks can be skipped, allowing access to protected routes.

Remediation

Users can update to Next.js versions 12.3.5, 13.5.9, 14.2.25, or 15.2.3. For those unable to update, it is recommended to block requests containing the 'x-middleware-subrequest' header from reaching the application.