Nextjs security testing

Nextjs Security Testing

penkit51 AI — professional penetration testing skill pack. Authorized testing only.

Deep Exploitation Guide

Next.js

Security testing for Next.js applications. Focus on authorization drift across runtimes (Edge/Node), caching boundaries, server actions, and middleware bypass.

Attack Surface

Routers

• App Router (app/) and Pages Router (pages/) often coexist
• Route Handlers (app/api/**) and API routes (pages/api/**)
• Middleware: middleware.ts at project root

Runtimes

• Node.js (full API access)
• Edge (V8 isolates, restricted APIs)

Rendering & Caching

• SSR, SSG, ISR, on-demand revalidation
• RSC (React Server Components) with fetch cache
• Draft/preview mode

Data Paths

• Server Components, Client Components
• Server Actions (streamed POST with Next-Action header)
• getServerSideProps, getStaticProps

Integrations

• NextAuth.js (callbacks, CSRF, callbackUrl)
• next/image optimization and remote loaders

High-Value Targets

• Middleware-protected routes (auth, geo, A/B)
• Admin/staff paths, draft/preview content, on-demand revalidate endpoints
• RSC payloads and flight data, streamed responses
• Image optimizer and custom loaders, remotePatterns/domains
• NextAuth callbacks (/api/auth/callback/*), sign-in providers
• Edge-only features (bot protection, IP gates) and their Node equivalents

Reconnaissance

Route Discovery

// Browser console - list all routes
console.log(__BUILD_MANIFEST.sortedPages.join('\n'))

// Inspect server-fetched data
JSON.parse(document.getElementById('__NEXT_DATA__').textContent).props.pageProps

// List public environment variables
Object.keys(process.env).filter(k => k.startsWith('NEXT_PUBLIC_'))

Build Artifacts

GET /_next/static/<buildId>/_buildManifest.js
GET /_next/static/<buildId>/_ssgManifest.js
GET /_next/static/chunks/pages/
GET /_next/static/chunks/app/

Chunk filenames map to routes (e.g., admin.js → /admin).

Source Maps

Check /_next/static/ for exposed .map files revealing route structure, server action IDs, and internal functions.

Client Bundle Mining

Search main-*.js for: pathname:, href:, __next_route__, serverActions, API endpoints. Grep for API_KEY, SECRET, TOKEN, PASSWORD to find accidentally leaked credentials.

Server Action Discovery

Inspect Network tab for POST requests with Next-Action header. Extract action IDs from response streams and hydration data.

Additional Leakage

• /sitemap.xml, /robots.txt, /sitemap-*.xml for unintended admin/internal/preview paths
• Client bundles/env for secret paths and preview/admin flags (many teams hide routes via UI only)

Key Vulnerabilities

Middleware Bypass

Known Techniques

• x-middleware-subrequest header crafting (CVE-class bypass)
• x-nextjs-data probing
• Look for 307 + x-middleware-rewrite/x-nextjs-redirect headers

Path Normalization

/api/users
/api/users/
/api//users
/api/./users

Middleware may normalize differently than route handlers. Test double slashes, trailing slashes, dot segments.

Parameter Pollution

?id=1&id=2
?filter[]=a&filter[]=b

Middleware checks first value, handler uses last or array.

Server Actions

• Invoke actions outside UI flow with alternate content-types
• Authorization assumed from client state rather than enforced server-side
• IDOR via object references in action payloads
• Map action IDs from source maps to discover hidden actions

RSC & Caching

Cache Boundary Failures

• User-bound data cached without identity keys (ETag/Set-Cookie unaware)
• Personalized content served from shared cache/CDN
• Missing no-store on sensitive fetches

Flight Data Leakage

Inspect streamed RSC payloads for serialized sensitive fields in props.

ISR Issues

• Stale-while-revalidate responses containing user-specific or tenant-dependent data
• Weak secrets in on-demand revalidation endpoint URLs
• Referer-disclosed tokens or unvalidated hosts triggering revalidatePath/revalidateTag
• Header-smuggling or method variations to trigger revalidation

Authentication

NextAuth Pitfalls

• Missing/relaxed state/nonce/PKCE per provider (login CSRF, token mix-up)
• Open redirect in callbackUrl or mis-scoped allowed hosts
• JWT audience/issuer not enforced across routes
• Cross-service token reuse
• Session hijacking by forcing callbacks

Session Boundaries

• Different auth enforcement between App Router and Pages Router
• API routes vs Route Handlers authorization inconsistency

Data Exposure

NEXT_DATA Over-fetching

Server-fetched data passed to client but not rendered:

• Full user objects when only username needed
• Internal IDs, tokens, admin-only fields
• ORM select-all patterns exposing entire records
• API responses forwarded without sanitization (metadata, cursors, debug info)

Environment-Dependent Exposure

• Staging/dev accidentally exposes more fields than production
• Inconsistent serialization logic across environments

Props Inspection

// Check for sensitive data in page props
JSON.parse(document.getElementById('__NEXT_DATA__').textContent).props

Look for _metadata, _internal, __typename (GraphQL), nested sensitive objects.

Image Optimizer SSRF

Remote Patterns

• Broad images.domains/remotePatterns in next.config.js
• Test: internal hosts, IPv4/IPv6 variants, DNS rebinding

Custom Loaders

• Protocol smuggling via redirect chains
• Cache poisoning via URL normalization differences affecting other users

Runtime Divergence

Edge vs Node

• Defenses relying on Node-only modules skipped on Edge
• Header trust differs (x-forwarded-* handling)
• Same route may behave differently across runtimes

Client-Side

XSS Vectors

• dangerouslySetInnerHTML
• Markdown renderers
• User-controlled href/src attributes
• Validate CSP/Trusted Types coverage for SSR/CSR/hydration

Hydration Mismatches

Server vs client render differences can enable gadget-based XSS.

Draft/Preview Mode

• Secret URLs/cookies enabling preview
• Preview secrets leaked in client bundles/env
• Setting preview cookies from subdomains or via open redirects

Bypass Techniques

• Content-type switching: application/json ↔ multipart/form-data ↔ application/x-www-form-urlencoded
• Method override: _method, X-HTTP-Method-Override, GET on endpoints accepting writes
• Case/param aliasing and query duplication affecting middleware vs handler parsing
• Cache key confusion at CDN/proxy (lack of Vary on auth cookies/headers)

Testing Methodology

1. Enumerate - Use __BUILD_MANIFEST, source maps, build artifacts, sitemap/robots to map all routes
2. Runtime matrix - Test each route under Edge and Node runtimes
3. Role matrix - Test as unauth/user/admin across SSR, API routes, Route Handlers, Server Actions
4. Cache probing - Verify caching respects identity (strip cookies, alter Vary headers, check ETags)
5. Middleware validation - Test path variants and header manipulation for bypass
6. Cross-router - Compare authorization between App Router and Pages Router paths

Validation Requirements

• Side-by-side requests showing cross-user/tenant access
• Cache boundary failure proof (response diffs, ETag collisions)
• Server action invocation outside UI with insufficient auth
• Middleware bypass with explicit headers showing protected content access
• Runtime parity checks (Edge vs Node inconsistent enforcement)
• Discovered routes verified as deployed (200/403) not just build artifacts (404)
• Leaked credentials tested with minimal read-only calls; filter placeholders
• __NEXT_DATA__ exposure: verify cross-user (User A's props shouldn't contain User B's PII), confirm exposed fields not in DOM
• Path normalization bypasses: show differential responses (403 vs 200), redirects don't count

Platform Methodology

Nextjs Security Testing

penkit51 AI — professional penetration testing skill pack. Authorized testing only.

Deep Exploitation Guide

Next.js

Security testing for Next.js applications. Focus on authorization drift across runtimes (Edge/Node), caching boundaries, server actions, and middleware bypass.

Attack Surface

Routers

• App Router (app/) and Pages Router (pages/) often coexist
• Route Handlers (app/api/**) and API routes (pages/api/**)
• Middleware: middleware.ts at project root

Runtimes

• Node.js (full API access)
• Edge (V8 isolates, restricted APIs)

Rendering & Caching

• SSR, SSG, ISR, on-demand revalidation
• RSC (React Server Components) with fetch cache
• Draft/preview mode

Data Paths

• Server Components, Client Components
• Server Actions (streamed POST with Next-Action header)
• getServerSideProps, getStaticProps

Integrations

• NextAuth.js (callbacks, CSRF, callbackUrl)
• next/image optimization and remote loaders

High-Value Targets

• Middleware-protected routes (auth, geo, A/B)
• Admin/staff paths, draft/preview content, on-demand revalidate endpoints
• RSC payloads and flight data, streamed responses
• Image optimizer and custom loaders, remotePatterns/domains
• NextAuth callbacks (/api/auth/callback/*), sign-in providers
• Edge-only features (bot protection, IP gates) and their Node equivalents

Reconnaissance

Route Discovery

// Browser console - list all routes
console.log(__BUILD_MANIFEST.sortedPages.join('\n'))

// Inspect server-fetched data
JSON.parse(document.getElementById('__NEXT_DATA__').textContent).props.pageProps

// List public environment variables
Object.keys(process.env).filter(k => k.startsWith('NEXT_PUBLIC_'))

Build Artifacts

GET /_next/static/<buildId>/_buildManifest.js
GET /_next/static/<buildId>/_ssgManifest.js
GET /_next/static/chunks/pages/
GET /_next/static/chunks/app/

Chunk filenames map to routes (e.g., admin.js → /admin).

Source Maps

Check /_next/static/ for exposed .map files revealing route structure, server action IDs, and internal functions.

Client Bundle Mining

Search main-*.js for: pathname:, href:, __next_route__, serverActions, API endpoints. Grep for API_KEY, SECRET, TOKEN, PASSWORD to find accidentally leaked credentials.

Server Action Discovery

Inspect Network tab for POST requests with Next-Action header. Extract action IDs from response streams and hydration data.

Additional Leakage

• /sitemap.xml, /robots.txt, /sitemap-*.xml for unintended admin/internal/preview paths
• Client bundles/env for secret paths and preview/admin flags (many teams hide routes via UI only)

Key Vulnerabilities

Middleware Bypass

Known Techniques

• x-middleware-subrequest header crafting (CVE-class bypass)
• x-nextjs-data probing
• Look for 307 + x-middleware-rewrite/x-nextjs-redirect headers

Path Normalization

/api/users
/api/users/
/api//users
/api/./users

Middleware may normalize differently than route handlers. Test double slashes, trailing slashes, dot segments.

Parameter Pollution

?id=1&id=2
?filter[]=a&filter[]=b

Middleware checks first value, handler uses last or array.

Server Actions

• Invoke actions outside UI flow with alternate content-types
• Authorization assumed from client state rather than enforced server-side
• IDOR via object references in action payloads
• Map action IDs from source maps to discover hidden actions

RSC & Caching

Cache Boundary Failures

• User-bound data cached without identity keys (ETag/Set-Cookie unaware)
• Personalized content served from shared cache/CDN
• Missing no-store on sensitive fetches

Flight Data Leakage

Inspect streamed RSC payloads for serialized sensitive fields in props.

ISR Issues

• Stale-while-revalidate responses containing user-specific or tenant-dependent data
• Weak secrets in on-demand revalidation endpoint URLs
• Referer-disclosed tokens or unvalidated hosts triggering revalidatePath/revalidateTag
• Header-smuggling or method variations to trigger revalidation

Authentication

NextAuth Pitfalls

• Missing/relaxed state/nonce/PKCE per provider (login CSRF, token mix-up)
• Open redirect in callbackUrl or mis-scoped allowed hosts
• JWT audience/issuer not enforced across routes
• Cross-service token reuse
• Session hijacking by forcing callbacks

Session Boundaries

• Different auth enforcement between App Router and Pages Router
• API routes vs Route Handlers authorization inconsistency

Data Exposure

NEXT_DATA Over-fetching

Server-fetched data passed to client but not rendered:

• Full user objects when only username needed
• Internal IDs, tokens, admin-only fields
• ORM select-all patterns exposing entire records
• API responses forwarded without sanitization (metadata, cursors, debug info)

Environment-Dependent Exposure

• Staging/dev accidentally exposes more fields than production
• Inconsistent serialization logic across environments

Props Inspection

// Check for sensitive data in page props
JSON.parse(document.getElementById('__NEXT_DATA__').textContent).props

Look for _metadata, _internal, __typename (GraphQL), nested sensitive objects.

Image Optimizer SSRF

Remote Patterns

• Broad images.domains/remotePatterns in next.config.js
• Test: internal hosts, IPv4/IPv6 variants, DNS rebinding

Custom Loaders

• Protocol smuggling via redirect chains
• Cache poisoning via URL normalization differences affecting other users

Runtime Divergence

Edge vs Node

• Defenses relying on Node-only modules skipped on Edge
• Header trust differs (x-forwarded-* handling)
• Same route may behave differently across runtimes

Client-Side

XSS Vectors

• dangerouslySetInnerHTML
• Markdown renderers
• User-controlled href/src attributes
• Validate CSP/Trusted Types coverage for SSR/CSR/hydration

Hydration Mismatches

Server vs client render differences can enable gadget-based XSS.

Draft/Preview Mode

• Secret URLs/cookies enabling preview
• Preview secrets leaked in client bundles/env
• Setting preview cookies from subdomains or via open redirects

Bypass Techniques

• Content-type switching: application/json ↔ multipart/form-data ↔ application/x-www-form-urlencoded
• Method override: _method, X-HTTP-Method-Override, GET on endpoints accepting writes
• Case/param aliasing and query duplication affecting middleware vs handler parsing
• Cache key confusion at CDN/proxy (lack of Vary on auth cookies/headers)

Testing Methodology

1. Enumerate - Use __BUILD_MANIFEST, source maps, build artifacts, sitemap/robots to map all routes
2. Runtime matrix - Test each route under Edge and Node runtimes
3. Role matrix - Test as unauth/user/admin across SSR, API routes, Route Handlers, Server Actions
4. Cache probing - Verify caching respects identity (strip cookies, alter Vary headers, check ETags)
5. Middleware validation - Test path variants and header manipulation for bypass
6. Cross-router - Compare authorization between App Router and Pages Router paths

Validation Requirements

• Side-by-side requests showing cross-user/tenant access
• Cache boundary failure proof (response diffs, ETag collisions)
• Server action invocation outside UI with insufficient auth
• Middleware bypass with explicit headers showing protected content access
• Runtime parity checks (Edge vs Node inconsistent enforcement)
• Discovered routes verified as deployed (200/403) not just build artifacts (404)
• Leaked credentials tested with minimal read-only calls; filter placeholders
• __NEXT_DATA__ exposure: verify cross-user (User A's props shouldn't contain User B's PII), confirm exposed fields not in DOM
• Path normalization bypasses: show differential responses (403 vs 200), redirects don't count

Validation & Reporting

• Confirm every finding with reproducible PoC before reporting
• Document: severity (CVSS), affected asset, steps, evidence, remediation
• Use record_vulnerability when running inside the penkit51 platform
• Chain low-severity findings into higher-impact attack paths
• Never report without evidence — distinguish hypothesis from confirmed vuln

Validation & Reporting

• Confirm every finding with reproducible PoC before reporting
• Document: severity (CVSS), affected asset, steps, evidence, remediation
• Use record_vulnerability when running inside the penkit51 platform
• Chain low-severity findings into higher-impact attack paths
• Never report without evidence — distinguish hypothesis from confirmed vuln