CVE-2025-55182 Scanner

A proof-of-concept scanner for CVE-2025-55182, a critical unauthenticated Remote Code Execution (RCE) vulnerability in React Server Components (RSC).

Overview

On December 3, 2025, a critical vulnerability was disclosed affecting React 19.x and Next.js applications using React Server Components. The flaw exists in the RSC "Flight" protocol's deserialization logic, allowing attackers to execute arbitrary code on the server via crafted HTTP requests.

Severity

Impact

• Unauthenticated Remote Code Execution
• Full server compromise
• Credential harvesting from environment variables
• Cloud metadata exfiltration
• Lateral movement within infrastructure

Affected Versions

Usage

Single Target Scan

go run ./cmd/main.go -t https://example.com

Single Target with Interactive Shell

go run ./cmd/main.go -t https://example.com -shell

Batch Scan from File

go run ./cmd/main.go -f targets.txt -c 20

Export Results

go run ./cmd/main.go -f targets.txt -json results.json -csv results.csv

Options

Output Example

React2Shell Scanner v1.0.0
CVE-2025-55182 | React Server Components RCE
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

[+] VULN  https://app.example.com/ 142ms
[-] SAFE  https://api.example.com/ 203ms
[!] ERROR https://internal.example.com/ (timeout) 15000ms

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
SCAN COMPLETE

  Targets scanned:    3
  Vulnerable:         1 (33%)
  Safe:               1
  Errors:             1

  Duration:           15.4s
  Avg response:       5115ms

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
VULNERABLE TARGETS

  1. https://app.example.com/

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
REMEDIATION

  Upgrade to patched versions:

  Next.js:
    15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7

  react-server-dom:
    19.0.1, 19.1.2, 19.2.1

Technical Details

The vulnerability exists in the RSC "Flight" protocol's handling of serialized payloads. When processing specially crafted multipart form data, the server fails to properly validate the payload structure, allowing prototype pollution that leads to arbitrary code execution.

Attack Vector

1. Attacker sends malformed RSC payload via POST request
2. Server deserializes payload without proper validation
3. Prototype pollution allows constructor access
4. Arbitrary JavaScript executes in Node.js context
5. Command output exfiltrated via redirect header

Detection

Look for POST requests containing:

• Next-Action header
• Multipart form data with __proto__ references
• Unusual X-Action-Redirect responses

Remediation

1. Immediate: Upgrade to patched versions listed above
2. WAF Rules: Block requests containing __proto__ in body
3. Monitoring: Alert on suspicious Next-Action header patterns
4. Network: Restrict outbound connections from Next.js servers

Disclaimer

INTERNAL USE ONLY

This tool is intended for authorized security testing only. Use against systems you own or have explicit permission to test. Unauthorized access to computer systems is illegal.

References

• Wiz Research Advisory
• React Security Bulletin
• Vercel Advisory

License

Internal use only. Not for distribution.