Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability lies in the lack of validation of the server action ID's length. An attacker could send a crafted request with a malformed ID to bypass authentication and enumerate internal server function endpoints. The patch addresses this by introducing the mightBeServerReferenceId function, which checks if the ID has the expected length. This check is added to the handleAction function, which is the main entry point for handling server actions, and to the createServerModuleMap function, which is responsible for looking up server reference IDs. By validating the ID's length at these points, the patch prevents the disclosure of internal server function endpoints.
handleActionpackages/next/src/server/app-render/action-handler.ts
createServerModuleMappackages/next/src/server/app-render/manifests-singleton.ts
createServerModuleMappackages/next/src/server/app-render/action-utils.ts
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| next | npm | >= 13.0.0, < 15.5.21 | 15.5.21 |
| next | npm | >= 16.0.0, < 16.2.11 | 16.2.11 |