CVE-2020-15242: 
JavaScript vulnerability analysis and mitigation

Next.js versions >=9.5.0 and <9.5.4 were found to be vulnerable to an Open Redirect vulnerability (CVE-2020-15242). The vulnerability was discovered and disclosed on October 8, 2020. The issue affected the trailing slash redirect functionality where specially encoded paths could be used to redirect users to external sites (Next.js Advisory).

The vulnerability allowed attackers to perform open redirects by manipulating specially encoded paths in combination with the trailing slash redirect feature. While deployments on Vercel and those using next export were not affected, all other installations running versions 9.5.0 through 9.5.3 were vulnerable. The issue was fixed in version 9.5.4 by implementing proper encoding handling for these types of redirects (Next.js Release).

The vulnerability could be exploited for phishing attacks by redirecting users from a trusted domain to an attacker's malicious domain. While the redirect itself does not directly harm users, it could be leveraged as part of social engineering attacks to gain user trust through the legitimate domain's reputation (Next.js Release).

The vulnerability could be identified by filtering logs of affected sites for %2F entries with a 308 response. The attack required user interaction to click on a specially crafted URL, though no special privileges were needed to execute the attack (AttackerKB).

The vulnerability was patched in version 9.5.4. Users were advised to upgrade by running 'npm install next@latest --save'. For those unable to upgrade immediately, administrators could filter for %2F with 308 responses in their logs to detect potential exploitation attempts (Next.js Release).

Next.js acknowledged that as their framework grew in popularity, it received increased attention from security teams and auditors. They expressed gratitude to the security teams that discovered and responsibly disclosed the vulnerability. The company also established a security mailing list for future security-related communications (Next.js Release).