devianntsec/cve-2025-55182
Master's thesis research on CVE-2025-55182 (React2Shell). Modular exploitation framework with 6 attack scenarios (RCE, exfiltration, defacement), interactive reverse shell, and a complete vulnerable lab for studying Prototype Pollution and Insecure Deserialization in React Server Components.
Deserialization of Untrusted Data + Prototype Pollution in React Server Components
Unauthenticated Remote Code Execution via Next.js Server Actions
Affected: React 19.0.0 - 19.2.0 · Patch: React 19.0.1 / 19.1.2 / 19.2.1 (December 3, 2025)
Demonstration of the advanced exploit - RCE basic commands, interactive shell, and multiple attack vectors against a vulnerable Next.js application
This repository contains my Master's Thesis research on CVE-2025-55182, a Critical (CVSS v3.1: 10.0) Remote Code Execution vulnerability in React Server Components.
The vulnerability originates from an unsafe deserialization mechanism in the React Flight protocol. When processing Server Actions, Next.js deserializes incoming multipart payloads without proper validation. An attacker can craft a malicious payload that pollutes the prototype chain and injects arbitrary JavaScript, which executes on the server via the Function constructor (and subsequently via child_process.execSync()).
Note on CVE-2025-66478: Vercel issued a parallel CVE to track the Next.js-specific impact of this same vulnerability. Because Next.js bundles React in a vendored manner, many dependency scanners do not automatically detect it as vulnerable. The US National Vulnerability Database (NVD) officially rejected CVE-2025-66478 as a duplicate of CVE-2025-55182, though it continues to be referenced in Vercel's own security advisory.
Follow-on vulnerabilities: The React team subsequently disclosed two additional issues present in the initial patch versions (19.0.1, 19.1.2, 19.2.1): CVE-2025-55184 (Denial of Service, CVSS 7.5) and CVE-2025-55183 (Source Code Exposure, CVSS 5.3). Users should upgrade to 19.0.2, 19.1.3, or 19.2.2 to address all three.
| Aspect | Description |
|---|---|
| Four attack modules | Delete projects, deface website, steal environment variables, shutdown servers |
| Interactive shell | Persistent shell with special commands and restoration capabilities |
| Stable exfiltration | Line-by-line reading to bypass HTTP header size limitations |
| Restoration script | Safe laboratory restoration after attacks |
| Academic documentation | Root cause, payload breakdown, and vulnerability timeline |
-brightred){kind=icon}
CVE-2025-55182/
├── README.md # This file
├── LICENSE # MIT License
│
├── exploit/
│ ├── exploit-explanation.md # Exploit usage documentation
│ └── react2shell.py # Main exploit — 4 attack modules + interactive shell
│
├── vulnerable-app/ # Vulnerable Next.js application
│ ├── README.md # Original vulnapp credits
│ ├── package.json # React 19.0.0 (vulnerable)
│ ├── app/ # Application source code
│ ├── curl_id.sh # Original exploit script (by zack0x01)
│ └── scripts/
│ └── restore.sh # Restoration script (my contribution)
│
└── docs/
├── screenshots/ # Exploitation demonstrations
│ ├── 01-app-initial.png
│ ├── 02-rce-basic.png
│ ├── 03-interactive-shell.png
│ ├── 04-no-payload.png
│ ├── 05-delete-result.png
│ ├── 06-deface.png
│ ├── 07-shutdown-servers.png
│ ├── 08-restore-from-script.png
│ └── 09-restore-from-interactive-shell.png
│
└── analysis/
├── 01-root-cause.md # Vulnerability root cause analysis
├── 02-payload-breakdown.md # Payload structure and execution flow
└── 03-timeline.md # CVE timeline
vulnerable-app/)cd vulnerable-app
npm install --legacy-peer-deps
npm run dev
# App available at http://localhost:3000
cd ../exploit
# Check if target is vulnerable
python3 react2shell.py -u http://localhost:3000 --check
# Execute single command
python3 react2shell.py -u http://localhost:3000 -c "whoami"
# Interactive shell mode
python3 react2shell.py -u http://localhost:3000 -i
| Module | Command | Description | Impact |
|---|---|---|---|
| Delete Projects | --delete-projects | Deletes all projects from dashboard | Data destruction |
| Deface | --deface "message" | Replaces the main page | Defacement |
| Steal Environment | --steal-env | Steals environment variables | Exfiltration |
| Shutdown Servers | --shutdown-servers | Shuts down all servers | Denial of Service |
React Server Components use a custom serialization/deserialization mechanism (the "Flight" protocol) to send component data from server to client. When processing server actions, the server deserializes incoming payloads without proper validation.
The core flaw is behavioral trust: the deserializer checks typeof obj.then === 'function' to identify Promises, without verifying that the property belongs directly to the object. This allows an attacker to poison Object.prototype.then, making every plain object appear as a thenable.
An attacker can craft a malicious payload that:
__proto__:thenFunction constructor via $1:constructor:constructornew Function(_prefix)process.mainModule.require('child_process').execSync()X-Action-Redirect HTTP response headerUser-mode (unauthenticated)
│
├─ POST / (Next.js Server Action endpoint)
│ ├─ Headers: Next-Action: x
│ └─ Multipart body with malicious JSON
│
└─ React Flight deserializer processes payload
└─ Prototype pollution via __proto__:then
└─ Function constructor reached via $1:constructor:constructor
└─ new Function(_prefix) executes attacker's JavaScript
└─ execSync() runs system command
└─ Output embedded in NEXT_REDIRECT error
└─ Next.js converts to X-Action-Redirect header
The vulnerability affects any Next.js application using the App Router with React Server Components — the default configuration since Next.js 14. Explicitly defined Server Actions are not required; the mere presence of the affected RSC packages is sufficient.
This vulnerability allows an unauthenticated attacker to: