I think my nextjs app got compromised
Unanswered
Rhinelander posted this in #help-forum
RhinelanderOP
Hi, i made a small nextjs webapp a while ago and let it run on my homeserver in a docker container and i think it somehow got compromised. i can provide a log file of the console output. I have no idea how they got in, but they changed the webpage and added a fake captcha to it. when doing the captcha it wants you to input a malicious windows command to windows + r and execute it. is anyone here who can help me with that. im not that experienced with this stuff and i do not know how far they got and if they managed to break out of the container. thanks a lot for any help, just message me
5 Replies
Sokoke
@Rhinelander check dm
Saint Hubert Jura Hound
Very possible yea. What version are you on? 2 big vulnerabilities in the last 6 months or so. You should completely wipe the device the server is running in as you cant be sure whether they escaped the docker container, then build a new image with the latest patch of whatever version ur using
Saint Hubert Jura Hound
To be safe u should also rotate any env vars the app uses.
Just for fun would u mind sending me an example of what the captcha would want you to paste?
And potentially if u wanna look further into this u could check the package.json for unknown or unusual packages. U can also check the .next folder and any CDN/cache for potential script tags that arent in ur source
Just for fun would u mind sending me an example of what the captcha would want you to paste?
And potentially if u wanna look further into this u could check the package.json for unknown or unusual packages. U can also check the .next folder and any CDN/cache for potential script tags that arent in ur source
Its also completely possible that the container has been compromised several times or by other people seeing as how long the vulnerabilities have been public for
So id also check other potentially conpromised locations like a cloud provider u use, github, etc