Critical Next.js ImageResponse Flaw Can Lead to Server Code Execution via Crafted SVG Input
Summary
A critical vulnerability in Next.js's ImageResponse feature allows attackers to execute code on a server by crafting malicious SVG input. This flaw is exploitable when user-controlled data, like text from a request URL, is incorporated into the generated social preview images. Vercel has released a fix for this issue.
IFF Assessment
This vulnerability allows for server-side code execution, posing a significant risk to defenders by enabling attackers to compromise servers.
Severity
The vulnerability allows for remote code execution on the server, which is a high-impact scenario. The attack vector involves crafted input, making it highly exploitable. The potential for unauthorized access and control over the server justifies a high CVSS score.
Defender Context
Developers using Next.js should urgently update to the patched version to mitigate the risk of server-side code execution. Defenders should be aware that this vulnerability could be leveraged in targeted attacks to compromise web applications and servers, potentially leading to further downstream impacts.