Next.js Open Redirect Scanner
Detects 'Open Redirect' vulnerability in Next.js affects v. <1.2.3.
Short Info
Level
Medium
Single Scan
Single Scan
Can be used by
Asset Owner
Estimated Time
10 seconds
Time Interval
18 days 22 hours
Scan only one
URL
Toolbox
-
Next.js is a popular React-based framework often used by web developers to create server-side rendered React applications. This software is widely used in various scenarios including websites, web applications, and hybrid mobile applications. It is favored in the tech industry by companies and individual developers for its scalability and ease of use. Organizations leverage Next.js for building performant web solutions due to its advanced features like automatic page optimization and support for static exports. Developers choose this framework for creating dynamic and interactive user interfaces quickly. Its broad ecosystem and strong community support make it a go-to choice for modern web development projects.
The open redirect vulnerability in Next.js stems from improper path parsing within the "_next/image" endpoint. This type of vulnerability occurs when a web application accepts untrusted input that could cause the application to redirect users to an unintended website. Open redirects are used in phishing attacks to trick users into visiting malicious websites. The vulnerability detected here can be exploited by crafting a URL that redirects the user to a potentially harmful external site. These issues generally arise due to inadequate validation of input paths provided by the user.
In technical terms, the vulnerability can be triggered at the "_next/image" endpoint of the application. The endpoint improperly parses the query parameters, specifically the path "url" parameter, allowing crafted redirection to another domain. The redirection happens upon accessing the crafted URL path, which might return a 308 status along with a manipulated location header. This allows attackers to redirect users from a trusted domain to an untrusted, potentially harmful site without their knowledge.
If exploited, this vulnerability could lead to significant security risks, including phishing attacks where users are tricked into divulging confidential information. It can diminish the trust users place in a brand or service due to unexpected redirects to malicious websites. Additionally, attackers could use this flaw to bypass security controls that depend on URL verification. The security reputations of websites utilizing vulnerable versions of Next.js might be compromised significantly. Moreover, direct consequences of such an exploit might include further compromise of client-side data integrity.
REFERENCES
