Lab 378 — PulseBoard — Cache Poisoning XSS via Next.js Header Misclassification

hackadvisor

Task: Next.js 14.2.9 analytics dashboard behind Nginx, /insights page reflects User-Agent unsanitized but is dynamic (not cached). Solution: Send x-now-route-matches header to trick Next.js into treating the page as static/ISR, making Nginx cache the XSS-poisoned response served to all visitors including admin bot whose flag cookie is exfiltrated via /api/feedback.