Miggo Logo
Miggo Vulnerability Database
→
CVE-2024-51479

CVE-2024-51479: Next.js authorization bypass vulnerability

7.5

CVSS Score
3.1

Basic Information

CVE ID
CVE-2024-51479
GHSA ID
GHSA-7gfc-8cq8-jh5f
EPSS Score
0.98815%
CWE
CWE-285
Published
12/17/2024
Updated
12/19/2024
KEV Status
No
Technology
TechnologyJavaScript

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
nextnpm>= 9.5.5, < 14.2.1514.2.15

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from improper handling of i18n query parameters in three key areas:

  1. base-server.ts's request processing didn't validate locale parameters, letting attackers inject arbitrary values to manipulate perceived paths
  2. resolve-routes.ts didn't clean i18n params without configuration, creating path resolution discrepancies
  3. Missing validation in i18n-provider.ts allowed invalid locales to persist. The patch added parameter validation/cleaning in these locations, confirming their role in the vulnerability. High confidence for first two due to direct security impact visible in commit diff; medium for i18n-provider as it was part of defense-in-depth fixes.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t I* * N*xt.js *ppli**tion is p*r*ormin* *ut*oriz*tion in mi**l*w*r* **s** on p*t*n*m*, it w*s possi*l* *or t*is *ut*oriz*tion to ** *yp*ss**. ### P*t***s T*is issu* w*s p*t**** in N*xt.js `**.*.**` *n* l*t*r. I* your N*xt.js *ppli**tion i

Reasoning

T** vuln*r**ility st*ms *rom improp*r **n*lin* o* i**n qu*ry p*r*m*t*rs in t*r** k*y *r**s: *. **s*-s*rv*r.ts's r*qu*st pro**ssin* *i*n't v*li**t* lo**l* p*r*m*t*rs, l*ttin* *tt**k*rs inj**t *r*itr*ry v*lu*s to m*nipul*t* p*r**iv** p*t*s *. r*solv*-r