Opennextjs Cloudflare
Monthly
Unauthenticated attackers can retrieve cached content from protected routes in OpenNext Cloudflare (@opennextjs/cloudflare) versions 0.3.0 through 1.20.2 when three deployment-specific conditions coincide: enableCacheInterception is set to true (an opt-in, non-default setting), access control is implemented with middleware matchers rather than inside route handlers, and the protected route has a matching entry in the incremental cache. Because middleware matching and cache-key lookup handle percent-encoded pathnames inconsistently, a request such as /%61dmin/%ZZ can evade authorization middleware while still resolving to the cache key of a protected route, disclosing cached content with no authentication or user interaction required. Rated CVSS 3.1 base 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), this is a confidentiality-only authorization bypass; no public exploit code has been identified at time of analysis, and the issue is resolved in @opennextjs/cloudflare 1.20.2.
Unauthenticated attackers can retrieve cached content from protected routes in OpenNext Cloudflare (@opennextjs/cloudflare) versions 0.3.0 through 1.20.2 when three deployment-specific conditions coincide: enableCacheInterception is set to true (an opt-in, non-default setting), access control is implemented with middleware matchers rather than inside route handlers, and the protected route has a matching entry in the incremental cache. Because middleware matching and cache-key lookup handle percent-encoded pathnames inconsistently, a request such as /%61dmin/%ZZ can evade authorization middleware while still resolving to the cache key of a protected route, disclosing cached content with no authentication or user interaction required. Rated CVSS 3.1 base 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), this is a confidentiality-only authorization bypass; no public exploit code has been identified at time of analysis, and the issue is resolved in @opennextjs/cloudflare 1.20.2.