PT-2022-16157 · Next.Js · Next.Js

Styfle · Published 2022-02-17 · Updated 2022-02-25 · CVE-2022-23646

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Next.js versions 10.0.0 through 12.1.0

Description Next.js is a React framework vulnerable to User Interface (UI) Misrepresentation of Critical Information. To be affected, the next.config.js file must have an images.domains array assigned, and the image host assigned in images.domains must allow user-provided SVG. If the next.config.js file has images.loader assigned to something other than default, the instance is not affected.

Recommendations For Next.js versions 10.0.0 through 12.0.10, update to version 12.1.0 to resolve the issue. As a temporary workaround for versions 10.0.0 through 12.0.10, change next.config.js to use a different loader configuration other than the default, for example, by setting images.loader to 'imgix' or 'custom'.

Exploit

Fix

UI Misrepresentation of Critical Information

Weakness Enumeration

CWE-451

Related Identifiers

CVE-2022-23646

GHSA-FMVM-X8MV-47MJ

Affected Products

Next.Js

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23646.json · Exploit
• https://github.com/vercel/next.js/security/advisories/GHSA-fmvm-x8mv-47mj · Patch
• https://github.com/vercel/next.js/pull/34075 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-23646 · Security Note
• https://osv.dev/vulnerability/GHSA-fmvm-x8mv-47mj · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-23646 · Vendor Advisory
• https://github.com/vercel/next.js · Note
• https://github.com/vercel/next.js/releases/tag/v12.1.0 · Note
• https://t.me/cvenotify/26940 · Telegram Post
• https://t.me/cibsecurity/37683 · Telegram Post