Rachid Allam

Metasploit · Author

Source-scoped identity with 1 associated PoC and 1 linked vulnerability.

Showing 1 PoC on this page

Metasploit

Next.js Middleware Authorization Bypass Scanner

Metasploit auxiliary PoCby Kenneth LaCroixAdded to Metasploit 2026-06-13ScannerCVE-2025-299271 file

auxiliary_scanner/http/nextjs_middleware_auth_bypass · Ruby

MetasploitPoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Metasploit auxiliary module that detects Next.js applications vulnerable to CVE-2025-29927 by sending a baseline request and a request with a crafted x-middleware-subrequest header, then comparing responses to determine if middleware authorization is bypassed. It reports vulnerability but does not exploit it.

Backdoor review

No backdoor observed in reviewed code

The module is a straightforward vulnerability scanner for CVE-2025-29927. It sends HTTP GET requests with and without the x-middleware-subrequest header to detect an authorization bypass. No backdoor, deceptive payload, or concealed harmful behavior is present. The code performs only detection and reporting, consistent with its documented purpose.

ClassificationScanner
Model confidence100%
AuthenticationNot required
Languagesruby
Target softwareNext.js
Attack typesauthorization bypass detection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The module description states 'This is detection only; the module does not act on the bypassed response.' The code only sends requests and compares responses to determine vulnerability; it does not extract data, establish sessions, or perform any post-bypass actions.

modules/auxiliary/scanner/http/nextjs_middleware_auth_bypass.rb:47

Requirements

  • Target must be a self-hosted Next.js application with middleware protecting a pathmodules/auxiliary/scanner/http/nextjs_middleware_auth_bypass.rb:33-40
  • User must supply a path normally gated by middleware (TARGETURI)modules/auxiliary/scanner/http/nextjs_middleware_auth_bypass.rb:72

Observed behavior

  • Sends a baseline GET request to the user-supplied TARGETURI and checks if the response status is a gate code (301, 302, 303, 307, 308, 401, 403)modules/auxiliary/scanner/http/nextjs_middleware_auth_bypass.rb:98-100modules/auxiliary/scanner/http/nextjs_middleware_auth_bypass.rb:130-131
  • Sends additional GET requests with various x-middleware-subrequest header values and compares responses to the baseline to detect if the middleware gate is bypassedmodules/auxiliary/scanner/http/nextjs_middleware_auth_bypass.rb:108-125
  • Reports the target as vulnerable if the gate disappears or the redirect target changes, and logs the vulnerability via report_vulnmodules/auxiliary/scanner/http/nextjs_middleware_auth_bypass.rb:137modules/auxiliary/scanner/http/nextjs_middleware_auth_bypass.rb:158-165
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Request
Payload withheldCore detection logic; sends crafted header to test for middleware bypass.modules/auxiliary/scanner/http/nextjs_middleware_auth_bypass.rb:111-115
Vulnerability Reporting
Payload withheldStandard Metasploit vulnerability reporting; no exfiltration or unrelated action.modules/auxiliary/scanner/http/nextjs_middleware_auth_bypass.rb:159-165
Review boundaries

What the analysis did not establish

  • Only the module source and metadata are provided; Metasploit framework mixins, libraries, and external payloads are not expanded, so the exact behavior of send_request_cgi and report_vuln is not verified from source.
  • Only the module source and metadata were reviewed; Metasploit framework mixins (e.g., HttpClient, Scanner) and external libraries are not expanded, but the module's own code shows no backdoor behavior.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.