CVE-2021-39178 : Security Advisory and Response

Next.js is a popular React framework. A cross-site scripting vulnerability exists in versions between 10.0.0 and 11.0.0, particularly affecting instances with specific configurations in the

next.config.js

file.

Understanding CVE-2021-39178

This CVE highlights a cross-site scripting vulnerability in Next.js versions 10.0.0 to 11.0.0.

What is CVE-2021-39178?

Next.js versions between 10.0.0 and 11.0.0 are susceptible to cross-site scripting (XSS) attacks due to improper input handling in the

images.domains

array of the

next.config.js

file.

The Impact of CVE-2021-39178

The CVSS v3.1 base score for this vulnerability is 7.5 (High severity) with a network-based attack vector and high impacts on confidentiality, integrity, and availability.

Technical Details of CVE-2021-39178

This section provides more in-depth technical insights into the vulnerability.

Vulnerability Description

The XSS vulnerability arises from improper neutralization of input during webpage generation, allowing attackers to execute arbitrary scripts.

Affected Systems and Versions

Product: Next.js
Vendor: Vercel
Versions Affected: >= 10.0.0, < 11.1.1

Exploitation Mechanism

To exploit the vulnerability, an attacker needs to inject malicious SVG code through the

images.domains

array in the

next.config.js

file.

Mitigation and Prevention

Understanding how to mitigate and prevent the exploitation of this vulnerability is crucial.

Immediate Steps to Take

Update Next.js to version 11.1.1 to patch the vulnerability.
Adjust the

images.domains

array to disallow user-provided SVG.

Long-Term Security Practices

Regularly review and update application configurations to follow secure coding practices.
Conduct security training for developers to increase awareness of XSS vulnerabilities.

Patching and Updates

Update to Next.js version 11.1.1 where the vulnerability is addressed.