PT-2021-21819 · Next.Js · Next.Js

Timneutkens · Published 2021-08-11 · Updated 2021-08-20 · CVE-2021-37699

Positive Technologies (AI Summary)

CVSS v3.1

6.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Next.js versions prior to 11.1.0

Description The issue in Next.js allows an open redirect to occur to an external site when specially encoded paths are used with statically generated pages/ error.js. This redirect does not directly harm users but can allow for phishing attacks by redirecting to an attacker's domain from a trusted domain.

Recommendations For versions prior to 11.1.0, upgrade to the latest version of Next.js to improve the overall security of your application. As a temporary workaround, consider restricting access to the pages/ error.js file until the issue is resolved. Avoid using specially encoded paths in the pages/ error.js file to minimize the risk of exploitation.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2021-37699

GHSA-VXF5-WXWP-M7G9

Affected Products

Next.Js

References · 9

• https://osv.dev/vulnerability/GHSA-vxf5-wxwp-m7g9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37699 · Security Note
• https://osv.dev/vulnerability/CVE-2021-37699 · Vendor Advisory
• https://github.com/vercel/next.js · Note
• https://github.com/vercel/next.js/security/advisories/GHSA-vxf5-wxwp-m7g9 · Note
• https://github.com/vercel/next.js/releases/tag/v11.1.0 · Note
• https://t.me/cibsecurity/27207 · Telegram Post
• https://t.me/cvenotify/19819 · Telegram Post
• https://t.me/cvenotify/19177 · Telegram Post