UNICORDev/exploit-CVE-2025-29927

GitHubRepository PoC

PoC files

13 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub

Docker lab environments

1
GitHub

vulnerable-next-app/docker-compose.yml

Created Vuln labCVE-2025-29927Compose · builds

1 Compose manifest · 1 Dockerfile · 1 service

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment for a Next.js 13.5.6 application with a login page and an admin dashboard protected by middleware. The README describes it as a test environment for CVE-2025-29927, a Next.js middleware authorization bypass vulnerability.

README.md:1-75vulnerable-next-app/docker-compose.yml:1-12vulnerable-next-app/Dockerfile:1-35

Lab assessment

Vulnerability lab

The README explicitly states the environment is a test environment for CVE-2025-29927, provides exploit usage instructions targeting the local app, and the included middleware implements authorization checks that are the subject of the vulnerability.

README.md:1-2README.md:60-64vulnerable-next-app/middleware.ts:1-36
Lab shapeCompose · builds
Services1
Compose manifests1
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

app

vulnerable Next.js web applicationtarget for CVE-2025-29927 exploit

A Next.js 13.5.6 application built from the local Dockerfile, exposed on port 3000. It includes a login page, an admin dashboard, and middleware that checks an 'auth' cookie to protect the /admin route.

vulnerable-next-app/docker-compose.yml:4-11vulnerable-next-app/Dockerfile:1-35vulnerable-next-app/package.json:10-11vulnerable-next-app/middleware.ts:1-36

exploit script (referenced)

exploit for CVE-2025-29927

A Python script referenced in the README that sends crafted requests with the x-middleware-subrequest header to bypass Next.js middleware authorization. It is not included in the evidence packet.

README.md:30-33README.md:60-64
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2025-29927

Supported by supplied evidence

The environment uses Next.js 13.5.6, which falls within the vulnerable range (13.0.0 - 13.5.8) specified in the README. The middleware implements authorization checks that the CVE describes as bypassable via the x-middleware-subrequest header.

vulnerable-next-app/package.json:10-11README.md:13-17README.md:53-57vulnerable-next-app/middleware.ts:1-36
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose installed to run the vulnerable app.README.md:60-64
  • Python 3 with requests and selenium libraries to run the exploit script.README.md:46-49requirements.txt:1-3

Evidence-described exercise path

  1. Start the vulnerable Next.js application using Docker Compose.README.md:60-62
  2. Run the exploit script against the local application to bypass middleware authorization.README.md:63
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The environment is a self-contained lab that runs a Next.js app in a container. The exploit targets the lab's own service on localhost. No evidence of host escape, external connections, persistence, credential theft, or destructive behavior is present.

vulnerable-next-app/docker-compose.yml:1-12README.md:60-64
Review boundaries

What the analysis did not establish

  • The exploit script (exploit-CVE-2025-29927.py) is referenced but not included in the evidence packet; its behavior cannot be inspected.
  • The Docker Compose file uses version '3', which is deprecated; the actual runtime behavior depends on the Docker Compose version used.
  • No runtime configuration (e.g., .env files) is included; the app's full behavior at runtime is not fully determined.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

1