CVE-2024-51479
Published: 17 December 2024
Summary
CVE-2024-51479 is a high-severity Improper Authorization (CWE-285) vulnerability in Vercel Next.Js. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 0.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Next.js, the React framework for full-stack web applications, contains an authorization bypass vulnerability in middleware pathname checks. When applications implement access controls based on URL paths, requests to pages located directly under the application root can evade those checks, while the root itself and deeper nested paths remain unaffected. The issue is tracked under CWE-285 and CWE-863 and carries a CVSS 7.5 rating reflecting network-exploitable confidentiality impact without authentication.
An unauthenticated remote attacker can craft requests to affected root-level routes and obtain access to resources or data that middleware authorization was intended to restrict. The flaw does not require user interaction or special privileges, allowing straightforward exploitation against any vulnerable deployment performing such checks.
The vulnerability is fixed in Next.js 14.2.15 and later releases. Applications hosted on Vercel receive automatic mitigation regardless of the framework version in use; no official workarounds are provided for self-hosted instances. The associated GitHub Security Advisory and release notes detail the patch and confirm the scope of affected path patterns.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-3534
Vulnerability details
Next.js is a React framework for building full-stack web applications. In affected versions if a Next.js application is performing authorization in middleware based on pathname, it was possible for this authorization to be bypassed for pages directly under the application's…
more
root directory. For example: * [Not affected] `https://example.com/` * [Affected] `https://example.com/foo` * [Not affected] `https://example.com/foo/bar`. This issue is patched in Next.js `14.2.15` and later. If your Next.js application is hosted on Vercel, this vulnerability has been automatically mitigated, regardless of Next.js version. There are no official workarounds for this vulnerability.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Documented procedures facilitate correct implementation and ongoing management of authorization decisions.
Periodic reviews identify and correct flaws in authorization decisions or enforcement.
Establishing permitted attributes and values, plus auditing changes, ensures authorization decisions are based on correctly managed policy data.
Explicitly mandates authorizing remote access types before permitting connections, directly mitigating improper authorization.
The control explicitly requires authorization of each wireless access type prior to permitting connections.
Mandating explicit authorization of mobile device connections reduces the risk of improper authorization decisions for system access.
Specifying access authorizations for each account and requiring approvals for account requests enforces proper authorization decisions.
Requires explicit authorization for individuals to use external systems to access or handle organization-controlled information.