Check Improper Authorization vulnerability

[yashaswi1004]

Summary

Hi @ijjk @ztanner @feedthejim @ everyone
can you tell me how to check whether Improper Authorization
vulnerability is not present in this version (v14.2.26)

Additional information

No response

Example

No response

[icyJoseph]

Hi,

As per, v14.2.25...v14.2.26 this releases diff, the fix backported to 14.2.26

Also remember that using middleware, as the only authentication touch point is not recommended. The docs have even been reworked to reflect that, https://github.com/vercel/next.js/pull/77438/files

[yashaswi1004]

Thanks @icyJoseph for the reply. I do have one doubt

so the Improper Authorization vulnerability is not present in v14.2.26?

how can i verify that the vulnerability is not present anymore in my code after updating to v14.2.26?

[icyJoseph]

You can run the steps here :) https://zhero-web-sec.github.io/research-and-things/nextjs-and-the-corrupt-middleware

[yashaswi1004]

Okay..what if my nextjs-sandbox doesn't have a middleware.js file at all?

[icyJoseph]

Aha, but then you should be fine I think. The security issue was that, you could bypass middleware. The problem is that people often used middleware to hide/protect a path, and then did not do further checks within that path. #63775 (reply in thread)

[yashaswi1004]

thank you @icyJoseph