zeit · next.js
A directory traversal flaw in zeit's Next.js framework (versions before 9.3.2) lets crafted requests reach files within the dist (.next) build directory. An attacker needs network access to the application and low privileges, plus user interaction, and exploitation is hard to achieve, with the exposure limited to build assets unless the application deliberately stores other content there.
Next.js versions before 9.3.2 have a directory traversal vulnerability. Attackers could craft special requests to access files in the dist directory (.next). This does not affect files outside of the dist directory (.next). In general, the dist directory only holds build assets unless your application intentionally stores other assets under this directory. This issue is fixed in version 9.3.2.
First seen exploited 6 years after disclosure.
CVE-specific rules are not available in this build. Search SigmaHQ ↗
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
1 package in 1 ecosystem. Main package: next.
Upgrade to 9.3.2 or later
npm install next@9.3.2The first fix for CVE-2020-5284.
| If you run | Upgrade to |
|---|---|
| 0.9.9 up to 9.3.2 | 9.3.2 |
“Up to” means the second version is the fix and is not affected.