CVE-2024-34351

Deeper analysis

Next.js, a React framework for building web applications, contains a Server-Side Request Forgery vulnerability in its Server Actions feature. The flaw is present when the framework runs in self-hosted mode, Server Actions are enabled, and an action performs a redirect to a relative path beginning with a forward slash; under these conditions an attacker who can alter the Host header can cause the application to issue requests that appear to originate from the server itself. The issue was corrected in Next.js version 14.1.1.

An unauthenticated remote attacker can exploit the weakness by crafting a request that manipulates the Host header and triggers a Server Action redirect. Successful exploitation grants the ability to reach internal or otherwise restricted network resources from the perspective of the Next.js server, resulting in high-impact information disclosure as reflected by the CVSS 7.5 rating and CWE-918 classification.

The official GitHub Security Advisory GHSA-fr5h-rqp8-mj6g and the associated pull request and commit (8f7a6ca7d21a97bc9f7a1bbe10427b5ad74b9085) confirm that upgrading to Next.js 14.1.1 fully resolves the SSRF vector; no additional configuration changes are documented as required beyond the version update. The EPSS score has remained at its peak value of 0.9275 since disclosure, indicating sustained exploitation interest.