HUNT-NEXTJS, Next.js / SSR Framework Vulnerabilities

Crown Jewel Targets

Next.js-specific bugs that bypass auth or reach SSRF = High/Critical.

Highest-value chains:

• Server Actions auth bypass, Server Actions enforce auth client-side only → call action ID directly → unauthorized data mutation or exfil
• Middleware bypass via /_next/static/, middleware skips static asset paths → protected routes accessible via /_next/data/ IDOR
• /_next/image SSRF, Image optimizer fetches attacker-controlled URL → internal network scan or cloud metadata
• ISR stale cache poisoning, inject malicious content into a cached page that gets served to all users
• RSC payload leakage, React Server Component flight data contains server-side props not meant for client

---

Attack Surface Signals

/_next/image?url=&w=&q=          Image optimizer, SSRF candidate
/_next/data/BUILD_ID/*.json      Prerendered page data, IDOR candidate
/__nextjs_original-stack-frame   Debug stack frame endpoint
/_next/static/chunks/            JS bundles, source map candidate
/api/                            API routes, standard hunt surface
__NEXT_DATA__ in HTML            SSR props leaked to client
x-nextjs-* response headers      Confirms Next.js

---

Phase 1, Fingerprint & Version Detection

# Confirm Next.js and get build ID
curl -s https://$TARGET/ | grep -oP '"buildId":"[^"]+"'
curl -sI https://$TARGET/ | grep -i "x-powered-by\|x-nextjs"

# Extract build ID for /_next/data/ paths
BUILD_ID=$(curl -s https://$TARGET/ | grep -oP '"buildId":"\K[^"]+')
echo "Build ID: $BUILD_ID"

# Check Next.js version via package disclosure
curl -s https://$TARGET/_next/static/chunks/framework*.js | grep -oP '"next":"[^"]+"'

# Source map exposure
curl -s "https://$TARGET/_next/static/chunks/pages/index.js.map" | head -5
curl -s "https://$TARGET/_next/static/chunks/main.js.map" | head -5

---

Phase 2, Server Actions Abuse