SIEM logs were analysed to understand how the attacker bypassed authentication, executed code, and moved laterally within the environment.

Initial Reconnaissance

Analysis of the web application revealed it was built using the Next.js framework.

Further inspection identified accessible endpoints that were not intended for public exposure, including administrative paths. These locations likely provided insight into the application's internal structure and potential attack surface.

Attack Activity

SIEM logs showed a high volume of requests originating from a single external IP address. The number and pattern of requests indicated automated probing of application endpoints rather than normal user behaviour.

This suggests the attacker was systematically identifying accessible routes and potential weaknesses.

Authentication Bypass

The framework version in use was associated with a known vulnerability that could allow authentication bypass.

Log analysis revealed the presence of a specific HTTP header linked to this exploit, confirming that the attacker leveraged this weakness to gain unauthorised access to protected functionality.

Post-Exploitation Activity

Following successful access, the attacker interacted with an internal API endpoint related to file handling.

This behaviour is consistent with attempts to upload malicious payloads. Evidence within the logs indicated an attempt to establish a reverse shell connection to an external system.

Command Execution

The reverse shell attempt demonstrates that the attacker achieved remote code execution on the web application server.

This represents a critical escalation from initial access to full system-level interaction.

Lateral Movement

After compromising the web server, the attacker attempted to move further into the environment.

Log data showed brute-force attempts over SSH, eventually resulting in successful access to another system using a valid account.

This confirms lateral movement and expansion of access within the network.

Findings

The attack followed a clear progression:

  • Reconnaissance of exposed application endpoints
  • Exploitation of a framework vulnerability to bypass authentication
  • Interaction with internal APIs to upload a payload
  • Execution of a reverse shell for remote access
  • Lateral movement using SSH brute-force

Each stage built upon the previous one, demonstrating a structured attack approach.

Conclusion

This investigation highlights how a single vulnerable component can lead to full compromise when combined with exposed functionality and weak internal controls.

Early detection at the reconnaissance or exploitation stage would significantly reduce the impact of such attacks.