Description

An overly permissive "remotePatterns" configuration in the Image component of a Next.js app can allow unauthenticated attackers to send arbitrary requests to any host, including those on internal networks that are otherwise inaccessible externally. This misconfiguration can be exploited to carry out SSRF (Server-Side Request Forgery) attacks on the server

Remediation

Restrict access to third-parties with "remotePatterns" in next.config.js

References

Related Vulnerabilities