CVE-2025-29927 Scanner

This Python script identifies hosts vulnerable to CVE-2025-29927, an improper authorization vulnerability in the Next.js middleware that may allow authentication bypass. The script checks for Next.js usage, identifies the version, detects the x-middleware-subrequest header, and tests for potential authentication bypasses on specified routes.

WARNING: This script is for educational purposes and authorized security audits only. Unauthorized use on systems without explicit permission is illegal and unethical.

Features

• Scans a list of hosts to detect Next.js usage.
• Identifies vulnerable Next.js versions (based on CVE-2025-29927).
• Tests authentication bypass on specified routes (via file or default).
• Supports parallel scanning with multiple threads.
• Automatically creates a routes.txt file with default routes if not provided.

Prerequisites

• Python 3.6 or higher
• Dependencies listed in requirements.txt

Installation

1. Clone or download this repository: git clone <REPOSITORY_URL> cd cve-2025-29927-scanner

2. Create and activate a virtual environment (optional, but recommended): python -m venv venv source venv/bin/activate # Linux/Mac venv\Scripts\activate # Windows

3. Install the dependencies: pip install -r requirements.txt

Usage

1. Prepare a hosts.txt file with a list of hosts (one per line). Example: example.com subdomain.example.com another-site.com

2. (Optional) Prepare a routes.txt file with routes to test (one per line). Example: api/auth dashboard admin If not provided, the script will automatically create a routes.txt with default routes.

3. Run the script:

   • Using default routes: python cve_2025_29927_scanner.py -f hosts.txt -t 10
   • Using a custom routes file: python cve_2025_29927_scanner.py -f hosts.txt -r custom_routes.txt -t 10

   Arguments: -f, --file: File with the list of hosts (required). -r, --routes: File with the list of routes (optional; uses routes.txt if not specified). -t, --threads: Maximum number of threads (default: 10).

4. Check the results in the terminal output.

Example Output

File routes.txt created with default routes.
Starting scan on 3 hosts with 3 routes...
Scan results:
------------------------------------------------------------
Host: https://example.com
Next.js detected: True
Version: 13.5.6
x-middleware-subrequest header: True
Vulnerable (version): True
Authentication bypass possible: True
Status: VULNERABLE
------------------------------------------------------------

Dependencies

The dependencies are listed in requirements.txt:

• requests>=2.31.0
• urllib3>=1.26.18

Mitigation for CVE-2025-29927

• Update Next.js to a non-affected version (see the official advisory: https://nextjs.org/docs/upgrading).
• Review middleware configuration to ensure robust authentication checks (see: https://nextjs.org/docs/middleware).

Contribution

Contributions are welcome