Next.js and cache poisoning: a quest for the black hole
Target Program: Vercel (NextJS)
🎯 Vulnerability: Remote Code Execution (RCE)
💡 Defense Fix: Avoid executing shell commands via system(). Use parameterized APIs and strict input sanitization.
More Writeups Like This
pentester.land
by Martin Doyhenard (@tincho_508)Gotta cache 'em all: bending the rules of web cache exploitation
pentester.land
by Gareth Heyes (@garethheyes)Splitting the email atom: exploiting parsers to bypass access controls
pentester.land
by Bahruz Jabiyev (@BahruzJabiyev), Anthony Gavazzi, Kaan Onarlioglu, Engin KirdaGudifu: Guided Differential Fuzzing for HTTP Request Parsing Discrepancies
pentester.land
by Abhijith Namboothiry