Working proof of concept for NextJS RCE to establish a reverse shell. [React2Shell]
This is a commercial, non-free Proof-of-Concept.
Purchase Link: https://bit.ly/44G0ani
This repository contains a reliable, high-fidelity Proof-of-Concept (PoC) exploit for CVE-2025-55182, also known as React2Shell. This is a critical (CVSS 10.0) Remote Code Execution (RCE) vulnerability affecting React Server Components (RSC) and, by extension, Next.js applications.
This commercial PoC includes multiple methods for detection and exploitation, providing flexibility for different testing scenarios:
Nuclei template for no-output vulnerability detection using DNS callbacks.Choose from three interactive reverse shell methods:
exp: Interactive shell using Base64 encoding over echo commands.exp2: Interactive shell using HTTP request hijacking with POST and Base64.exp3: Interactive shell using HTTP request hijacking with POST and AES-256-CBC encryption.
This PoC demonstrates the reliable exploitation of CVE-2025-55182 (React2Shell), a critical Remote Code Execution vulnerability in Next.js applications using React Server Components. Our exploit provides security researchers and penetration testers with a validated, one-shot method to achieve unauthenticated command execution on default-configuration targets.
The PoC exploits a server-side prototype pollution flaw within the RSC "Flight" protocol's deserialization. By submitting a single, specially crafted HTTP POST request, the vulnerability can be triggered to escape the React serialization context and execute arbitrary operating system commands on the hosting server.
Key Technical Mechanism:
The exploit crafts a multi-part form-data request containing a circular JSON structure. This structure abuses the deserialization process to pollute the prototype chain, ultimately causing the server to resolve a path traversal string ("$1:constructor:constructor"). This traversal returns the JavaScript Function constructor, which is then invoked with attacker-controlled code, leading directly to Remote Code Execution (RCE).
id, whoami) to confirm execution.To distinguish a high-quality, functional PoC from the numerous incomplete or deceptive scripts circulating online, refer to the following criteria:
| Evaluation Criteria | This PoC (Functional) | Common Low-Quality Scripts |
|---|---|---|
| Target Requirement | Works on a default create-next-app setup. | Require manual, unsafe exposure of modules like child_process. |
| Exploitation Basis | Directly exploits the RSC prototype pollution & deserialization bug. | May demonstrate unrelated issues or incorrect methods. |
| Request Signature | Uses correct POST with Next-Action header and complex multi-part body. | Often use simplistic, incorrect request structures. |
| Execution Proof | Provides full system command execution (e.g., create files, run commands). | Limited to returning version info or causing crashes. |
This PoC is intended strictly for:
The seller and creator assume no liability for any misuse of this tool. It is the buyer's sole responsibility to use it legally and ethically.