FKIE_CVE-2025-6087
Vulnerability from fkie_nvd - Published: 2025-06-16 19:15 - Updated: 2025-08-06 17:21
Severity ?
Summary
A Server-Side Request Forgery (SSRF) vulnerability was identified in the @opennextjs/cloudflare package. The vulnerability stems from an unimplemented feature in the Cloudflare adapter for Open Next, which allowed unauthenticated users to proxy arbitrary remote content via the /_next/image endpoint.
This issue allowed attackers to load remote resources from arbitrary hosts under the victim site’s domain for any site deployed using the Cloudflare adapter for Open Next.
For example:
https://victim-site.com/_next/image?url=https://attacker.com
In this example, attacker-controlled content from attacker.com is served through the victim site’s domain (victim-site.com), violating the same-origin policy and potentially misleading users or other services.
Impact:
* SSRF via unrestricted remote URL loading
* Arbitrary remote content loading
* Potential internal service exposure or phishing risks through domain abuse
Mitigation:
The following mitigations have been put in place:
* Server side updates to Cloudflare’s platform to restrict the content loaded via the /_next/image endpoint to images. The update automatically mitigates the issue for all existing and any future sites deployed to Cloudflare using the affected version of the Cloudflare adapter for Open Next
* Root cause fix https://github.com/opennextjs/opennextjs-cloudflare/pull/727 to the Cloudflare adapter for Open Next. The patched version of the adapter is found here @opennextjs/cloudflare@1.3.0 https://www.npmjs.com/package/@opennextjs/cloudflare/v/1.3.0
* Package dependency update https://github.com/cloudflare/workers-sdk/pull/9608 to create-cloudflare (c3) to use the fixed version of the Cloudflare adapter for Open Next. The patched version of create-cloudflare is found here: create-cloudflare@2.49.3 https://www.npmjs.com/package/create-cloudflare/v/2.49.3
In addition to the automatic mitigation deployed on Cloudflare’s platform, we encourage affected users to upgrade to @opennext/cloudflare v1.3.0 and use the remotePatterns https://nextjs.org/docs/pages/api-reference/components/image#remotepatterns filter in Next config https://nextjs.org/docs/pages/api-reference/components/image#remotepatterns if they need to allow-list external urls with images assets.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cloudflare | create-cloudflare | * | |
| opennextjs | opennext_for_cloudflare | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cloudflare:create-cloudflare:*:*:*:*:*:node.js:*:*",
"matchCriteriaId": "75F34FC9-679E-4655-B803-E84B045271CC",
"versionEndExcluding": "2.49.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:opennextjs:opennext_for_cloudflare:*:*:*:*:*:node.js:*:*",
"matchCriteriaId": "0EDFEC99-0FB1-4E53-9FC6-DDD1C68AA214",
"versionEndExcluding": "1.3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A Server-Side Request Forgery (SSRF) vulnerability was identified in the @opennextjs/cloudflare package. The vulnerability stems from an unimplemented feature in the Cloudflare adapter for Open Next, which allowed unauthenticated users to proxy arbitrary remote content via the /_next/image endpoint.\n\nThis issue allowed attackers to load remote resources from arbitrary hosts under the victim site\u2019s domain for any site deployed using the Cloudflare adapter for Open Next.\u00a0\n\n\n\n\nFor example:\n\n https://victim-site.com/_next/image?url=https://attacker.com \n\nIn this example, attacker-controlled content from attacker.com is served through the victim site\u2019s domain (victim-site.com), violating the same-origin policy and potentially misleading users or other services.\n\n\n\n\nImpact:\n\n * SSRF via unrestricted remote URL loading\n\n\n\n\n * Arbitrary remote content loading\n\n\n\n\n * Potential internal service exposure or phishing risks through domain abuse\n\n\n\n\n\n\n\nMitigation:\n\nThe following mitigations have been put in place:\n\n * Server side updates to Cloudflare\u2019s platform to restrict the content loaded via the\u00a0/_next/image\u00a0endpoint to images. The update automatically mitigates the issue for all existing and any future sites deployed to Cloudflare using the affected version of the Cloudflare adapter for Open Next\n\n\n\n\n * Root cause fix https://github.com/opennextjs/opennextjs-cloudflare/pull/727 \u00a0to the Cloudflare adapter for Open Next. The patched version of the adapter is found here\u00a0 @opennextjs/cloudflare@1.3.0 https://www.npmjs.com/package/@opennextjs/cloudflare/v/1.3.0 \n\n\n * Package dependency update https://github.com/cloudflare/workers-sdk/pull/9608 \u00a0to create-cloudflare (c3) to use the fixed version of the Cloudflare adapter for Open Next. The patched version of create-cloudflare is found here:\u00a0 create-cloudflare@2.49.3 https://www.npmjs.com/package/create-cloudflare/v/2.49.3 \n\n\n\n\nIn addition to the automatic mitigation deployed on Cloudflare\u2019s platform, we encourage affected users to upgrade to @opennext/cloudflare v1.3.0 and use the remotePatterns https://nextjs.org/docs/pages/api-reference/components/image#remotepatterns filter in Next config https://nextjs.org/docs/pages/api-reference/components/image#remotepatterns if they need to allow-list external urls with images assets."
},
{
"lang": "es",
"value": "Se identific\u00f3 una vulnerabilidad de Server-Side Request Forgery (SSRF) en el paquete @opennextjs/cloudflare. Esta vulnerabilidad se debe a una funci\u00f3n no implementada en el adaptador de Cloudflare para Open Next, que permit\u00eda a usuarios no autenticados acceder a contenido remoto arbitrario mediante el endpoint /_next/image. Este problema permit\u00eda a los atacantes cargar recursos remotos desde hosts arbitrarios bajo el dominio del sitio web v\u00edctima para cualquier sitio implementado con el adaptador de Cloudflare para Open Next. Por ejemplo: https://victim-site.com/_next/image?url=https://attacker.com. En este ejemplo, el contenido controlado por el atacante desde attacker.com se distribuye a trav\u00e9s del dominio del sitio web v\u00edctima (victim-site.com), lo que infringe la pol\u00edtica de mismo origen y podr\u00eda inducir a error a usuarios u otros servicios. Impacto: * SSRF mediante carga remota de URL sin restricciones * Carga remota arbitraria de contenido * Posible exposici\u00f3n interna del servicio o riesgos de phishing por abuso de dominio. Mitigaci\u00f3n: Se han implementado las siguientes mitigaciones: * Actualizaciones del servidor en la plataforma de Cloudflare para restringir el contenido cargado a trav\u00e9s del endpoint /_next/image a im\u00e1genes. La actualizaci\u00f3n mitiga autom\u00e1ticamente el problema en todos los sitios existentes y futuros implementados en Cloudflare que utilicen la versi\u00f3n afectada del adaptador de Cloudflare para Open Next. * Correcci\u00f3n de la causa ra\u00edz (https://github.com/opennextjs/opennextjs-cloudflare/pull/727) en el adaptador de Cloudflare para Open Next. La versi\u00f3n parcheada del adaptador se encuentra aqu\u00ed @opennextjs/cloudflare@1.3.0 https://www.npmjs.com/package/@opennextjs/cloudflare/v/1.3.0 * Actualizaci\u00f3n de la dependencia del paquete https://github.com/cloudflare/workers-sdk/pull/9608 para create-cloudflare (c3) para usar la versi\u00f3n corregida del adaptador de Cloudflare para Open Next. La versi\u00f3n parcheada de create-cloudflare se encuentra aqu\u00ed: create-cloudflare@2.49.3 https://www.npmjs.com/package/create-cloudflare/v/2.49.3 Adem\u00e1s de la mitigaci\u00f3n autom\u00e1tica implementada en la plataforma de Cloudflare, recomendamos a los usuarios afectados que actualicen a @opennext/cloudflare v1.3.0 y utilicen el filtro remotePatterns https://nextjs.org/docs/pages/api-reference/components/image#remotepatterns en la configuraci\u00f3n de Next https://nextjs.org/docs/pages/api-reference/components/image#remotepatterns si necesitan incluir en la lista de permitidos URL externas con recursos de im\u00e1genes."
}
],
"id": "CVE-2025-6087",
"lastModified": "2025-08-06T17:21:28.460",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.2,
"source": "nvd@nist.gov",
"type": "Primary"
}
],
"cvssMetricV40": [
{
"cvssData": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityRequirement": "NOT_DEFINED",
"exploitMaturity": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"source": "cna@cloudflare.com",
"type": "Secondary"
}
]
},
"published": "2025-06-16T19:15:33.837",
"references": [
{
"source": "cna@cloudflare.com",
"tags": [
"Product"
],
"url": "https://github.com/opennextjs/opennextjs-cloudflare"
}
],
"sourceIdentifier": "cna@cloudflare.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-918"
}
],
"source": "cna@cloudflare.com",
"type": "Secondary"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…