CVE-2020-5284 Directory Traversal in Next.js versions below 9.3.2
Attackers can access files in the dist directory via crafted requests, potentially exposing build assets or sensitive data stored there.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-5284?
CVE-2020-5284 is a medium-severity path traversal vulnerability in zeit next.js, published on 30 Mar 2020. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Next.js versions before 9.3.2 have a directory traversal vulnerability. Attackers could craft special requests to access files in the dist directory (.next). This does not affect files outside of the dist directory (.next). In general, the dist directory only holds build assets unless your application intentionally stores other assets under this directory. This issue is fixed in version 9.3.2.
Which versions are affected by CVE-2020-5284?
2 open source packages ship an affected version, including next. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
next npm | From 0.9.9 | 9.3.2 |
next npm | From 0.9.9 | 9.3.2 |
Products include Zeit Next.js.
How do I fix CVE-2020-5284?
Upgrade next to 9.3.2 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2020-5284 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-5284 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in zeit next.js
Sources
Also known as GHSA-fq77-7p7r-83rj.