« Volver al listado

CVE-2025-6087

Estado: AnalizadaAlta (7.8)—

A Server-Side Request Forgery (SSRF) vulnerability was identified in the @opennextjs/cloudflare package. The vulnerability stems from an unimplemented feature in the Cloudflare adapter for Open Next, which allowed unauthenticated users to proxy arbitrary remote content via the /_next/image endpoint.

This issue allowed attackers to load remote resources from arbitrary hosts under the victim site’s domain for any site deployed using the Cloudflare adapter for Open Next.

For example:

https://victim-site.com/_next/image?url=https://attacker.com

In this example, attacker-controlled content from attacker.com is served through the victim site’s domain (victim-site.com), violating the same-origin policy and potentially misleading users or other services.

Leer descripción completaMostrar menos

Impact:

Mitigation:

The following mitigations have been put in place:

In addition to the automatic mitigation deployed on Cloudflare’s platform, we encourage affected users to upgrade to @opennext/cloudflare v1.3.0 and use the remotePatterns https://nextjs.org/docs/pages/api-reference/components/image#remotepatterns filter in Next config https://nextjs.org/docs/pages/api-reference/components/image#remotepatterns if they need to allow-list external urls with images assets.

Detalles técnicos trazas, registros y código del informe original
  *  SSRF via unrestricted remote URL loading

  *  Arbitrary remote content loading

  *  Potential internal service exposure or phishing risks through domain abuse

  *  Server side updates to Cloudflare’s platform to restrict the content loaded via the /_next/image endpoint to images. The update automatically mitigates the issue for all existing and any future sites deployed to Cloudflare using the affected version of the Cloudflare adapter for Open Next

  *   Root cause fix https://github.com/opennextjs/opennextjs-cloudflare/pull/727  to the Cloudflare adapter for Open Next. The patched version of the adapter is found here  @opennextjs/cloudflare@1.3.0 https://www.npmjs.com/package/@opennextjs/cloudflare/v/1.3.0

  *   Package dependency update https://github.com/cloudflare/workers-sdk/pull/9608  to create-cloudflare (c3) to use the fixed version of the Cloudflare adapter for Open Next. The patched version of create-cloudflare is found here:  create-cloudflare@2.49.3 https://www.npmjs.com/package/create-cloudflare/v/2.49.3

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

SSRF en endpoint /_next/image sin autenticación (AV:N/PR:N/UI:N) permite proxying de contenido remoto arbitrario bajo el dominio víctima; CWE-918 y ejemplo con attacker.com confirman proxy SSRF (T1090); riesgo de phishing y ocultamiento de origen de peticiones.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Filter Network TrafficVulnerability ScanningUser TrainingSSL/TLS InspectionPrivileged Account ManagementNetwork Segmentation

Tecnologías afectadas (2)

Cloudflare — Create-cloudflareOpennextjs — Opennext FOR Cloudflare

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-6087",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-6087",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-06-16T18:55:28.409358Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.1,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 3.9
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "cna@cloudflare.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 7.8,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "LOW",
          "vulnIntegrityImpact": "LOW",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "HIGH",
          "vulnConfidentialityImpact": "LOW",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "cna@cloudflare.com",
      "affectedData": [
        {
          "repo": "https://github.com/opennextjs/opennextjs-cloudflare",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "1.3.0",
              "versionType": "git"
            }
          ],
          "packageName": "opennextjs-cloudflare",
          "collectionURL": "https://github.com/opennextjs",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-06-16T19:15:33.837",
  "references": [
    {
      "url": "https://github.com/opennextjs/opennextjs-cloudflare",
      "tags": [
        "Product"
      ],
      "source": "cna@cloudflare.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cna@cloudflare.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A Server-Side Request Forgery (SSRF) vulnerability was identified in the @opennextjs/cloudflare package. The vulnerability stems from an unimplemented feature in the Cloudflare adapter for Open Next, which allowed unauthenticated users to proxy arbitrary remote content via the /_next/image endpoint.\n\nThis issue allowed attackers to load remote resources from arbitrary hosts under the victim site’s domain for any site deployed using the Cloudflare adapter for Open Next. \n\n\n\n\nFor example:\n\n https://victim-site.com/_next/image?url=https://attacker.com \n\nIn this example, attacker-controlled content from attacker.com is served through the victim site’s domain (victim-site.com), violating the same-origin policy and potentially misleading users or other services.\n\n\n\n\nImpact:\n\n  *  SSRF via unrestricted remote URL loading\n\n\n\n\n  *  Arbitrary remote content loading\n\n\n\n\n  *  Potential internal service exposure or phishing risks through domain abuse\n\n\n\n\n\n\n\nMitigation:\n\nThe following mitigations have been put in place:\n\n  *  Server side updates to Cloudflare’s platform to restrict the content loaded via the /_next/image endpoint to images. The update automatically mitigates the issue for all existing and any future sites deployed to Cloudflare using the affected version of the Cloudflare adapter for Open Next\n\n\n\n\n  *   Root cause fix https://github.com/opennextjs/opennextjs-cloudflare/pull/727  to the Cloudflare adapter for Open Next. The patched version of the adapter is found here  @opennextjs/cloudflare@1.3.0 https://www.npmjs.com/package/@opennextjs/cloudflare/v/1.3.0 \n\n\n  *   Package dependency update https://github.com/cloudflare/workers-sdk/pull/9608  to create-cloudflare (c3) to use the fixed version of the Cloudflare adapter for Open Next. The patched version of create-cloudflare is found here:  create-cloudflare@2.49.3 https://www.npmjs.com/package/create-cloudflare/v/2.49.3 \n\n\n\n\nIn addition to the automatic mitigation deployed on Cloudflare’s platform, we encourage affected  users to upgrade to @opennext/cloudflare v1.3.0 and use the  remotePatterns  https://nextjs.org/docs/pages/api-reference/components/image#remotepatterns  filter in Next config https://nextjs.org/docs/pages/api-reference/components/image#remotepatterns  if they need to allow-list external urls with images assets."
    },
    {
      "lang": "es",
      "value": "Se identificó una vulnerabilidad de Server-Side Request Forgery (SSRF) en el paquete @opennextjs/cloudflare. Esta vulnerabilidad se debe a una función no implementada en el adaptador de Cloudflare para Open Next, que permitía a usuarios no autenticados acceder a contenido remoto arbitrario mediante el endpoint /_next/image. Este problema permitía a los atacantes cargar recursos remotos desde hosts arbitrarios bajo el dominio del sitio web víctima para cualquier sitio implementado con el adaptador de Cloudflare para Open Next. Por ejemplo: https://victim-site.com/_next/image?url=https://attacker.com. En este ejemplo, el contenido controlado por el atacante desde attacker.com se distribuye a través del dominio del sitio web víctima (victim-site.com), lo que infringe la política de mismo origen y podría inducir a error a usuarios u otros servicios. Impacto: * SSRF mediante carga remota de URL sin restricciones * Carga remota arbitraria de contenido * Posible exposición interna del servicio o riesgos de phishing por abuso de dominio. Mitigación: Se han implementado las siguientes mitigaciones: * Actualizaciones del servidor en la plataforma de Cloudflare para restringir el contenido cargado a través del endpoint /_next/image a imágenes. La actualización mitiga automáticamente el problema en todos los sitios existentes y futuros implementados en Cloudflare que utilicen la versión afectada del adaptador de Cloudflare para Open Next. * Corrección de la causa raíz (https://github.com/opennextjs/opennextjs-cloudflare/pull/727) en el adaptador de Cloudflare para Open Next. La versión parcheada del adaptador se encuentra aquí @opennextjs/cloudflare@1.3.0 https://www.npmjs.com/package/@opennextjs/cloudflare/v/1.3.0 * Actualización de la dependencia del paquete https://github.com/cloudflare/workers-sdk/pull/9608 para create-cloudflare (c3) para usar la versión corregida del adaptador de Cloudflare para Open Next. La versión parcheada de create-cloudflare se encuentra aquí: create-cloudflare@2.49.3 https://www.npmjs.com/package/create-cloudflare/v/2.49.3 Además de la mitigación automática implementada en la plataforma de Cloudflare, recomendamos a los usuarios afectados que actualicen a @opennext/cloudflare v1.3.0 y utilicen el filtro remotePatterns https://nextjs.org/docs/pages/api-reference/components/image#remotepatterns en la configuración de Next https://nextjs.org/docs/pages/api-reference/components/image#remotepatterns si necesitan incluir en la lista de permitidos URL externas con recursos de imágenes."
    }
  ],
  "lastModified": "2026-06-17T10:01:07.517",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cloudflare:create-cloudflare:*:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "75F34FC9-679E-4655-B803-E84B045271CC",
              "versionEndExcluding": "2.49.3"
            },
            {
              "criteria": "cpe:2.3:a:opennextjs:opennext_for_cloudflare:*:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0EDFEC99-0FB1-4E53-9FC6-DDD1C68AA214",
              "versionEndExcluding": "1.3.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cna@cloudflare.com"
}