Vulnerable software · Scan + Code · first seen 1 Oct · CVE-2024-34351
HighConfirmed exploitableFix submittedKelvin Obisesanfix by 31 Oct
Fix submitted by Kelvin · rescan running since 10:19
PR #488 shipped the fix to api this morning; the rescan running now will say if it holds. The sandbox branch still pins 14.1.0.
One problem in four places, found two ways. Proven in one, fixed in one, still open in three.
2 sources · 4 places
Scan
First found Thu 1 Oct, last seen Mon 12 Oct
Code
deps/npm · sandbox branch
It closes only when all of these are true
Nobody can mark it fixed by hand. A person submits the fix; a scan or a retest decides it.
3rd of 39 in your queue
Proof first, then exploitation in the wild, a public exploit, EPSS and severity, adjusted for exposure and how much the asset matters
Priority
90 / 100
What each source saw
As each source gives it · secrets, keys and card numbers stay masked
The scan's case file · tessellatepay.com
See it in that scanWhy it matters here
Proven on api.tessellatepay.com: our template made your server call out to us. An attacker can use the API server to reach internal services, including the AWS metadata endpoint that hands out credentials.
Proof
Our template for CVE-2024-34351 fired on api.tessellatepay.com at 02:19, and the server answered the way only a vulnerable one does. On api-sandbox.tessellatepay.com it didn’t fire, which can mean sign-in stood in the way, not that it’s safe.
What we saw, on 2 hosts
api.tessellatepay.com shows Next.js 14.1.0, a version this advisory covers. We matched the version; the proof, where there is one, is above.
The advisory
A Server-Side Request Forgery (SSRF) vulnerability was identified in Next.js Server Actions. If the Host header is modified, and the below conditions are met, an attacker may be able to make requests that appear to originate from the Next.js application server itself.
Prerequisites
<14.1.1) is running in a self-hosted manner./.Patches
This vulnerability was patched in Next.js 14.1.1.
The fix
Upgrade Next.js to 14.1.1 or later on every host that runs it, and redeploy. The sandbox API runs the same build.
Where
Detected
Next.js 14.1.0
How likely
Sources
Proven Mon 12 Oct, 02:19
The code · tessellate/payments-api · sandbox branch
Open the repositorypackage.json · on sandbox
| 30 | "jose": "^4.15.4", |
| 31 | "jsonwebtoken": "8.5.1", |
| 32 | "next": "14.1.0", |
| 33 | "pino": "^8.17.2", |
Reached
src/app/actions.ts uses Server Actions that redirect to a relative path.
The fix
Merge main into sandbox (PR #488 already upgraded next on main), and redeploy api-sandbox.
The code · tessellate/payments-api · fixed
Open the repositorypackage.json
| 30 | "jose": "^4.15.4", |
| 31 | "jsonwebtoken": "8.5.1", |
| 32 | "next": "14.2.15", |
| 33 | "pino": "^8.17.2", |
The fix
Upgraded to 14.2.15 in PR #488.
What happened, and what was said
7 events · 2 comments · oldest first