CVE-2025-55182 Vulnerability Detection and Exploitation Tool

Project Introduction

This tool is a GUI tool developed based on Java Swing, used for detecting and exploiting the CVE-2025-55182 vulnerability. This vulnerability is a security flaw in the Next.js framework that allows attackers to execute arbitrary commands through specially crafted requests.

Features

1. Vulnerability Detection

• Supports batch URL scanning
• Multi-threaded concurrent scanning to improve detection speed
• Real-time display of scan progress and count (e.g., 1/1000 (0%))
• Only displays vulnerable targets, filtering out irrelevant information
• Supports importing files for batch detection
• Provides a stop scanning function

2. Command Execution

• Supports executing Linux/Windows commands
• Automatic or manual selection of target operating system
• Real-time display of command execution results

3. Web Shell Injection

• Supports injecting simple command execution web shells
• Supports injecting Godzilla web shells (with RC4 encryption)
• Automatically generates connection information and usage instructions

4. Reverse Shell

• Supports Linux/Windows reverse shells
• Supports custom reverse shell commands
• Provides multiple reverse shell methods (Linux named pipe, Windows PowerShell)

Technical Architecture

• Development Language: Java
• GUI Framework: Swing
• Network Communication: HttpURLConnection
• Concurrency: ExecutorService thread pool
• Project Management: Maven

Environment Requirements

• JDK 8 or higher
• Maven 3.6 or higher

Compilation and Execution

1. Compile the Project

# Enter the project directory
cd CVE202555182GUI

# Compile and package
mvn clean package

2. Run the Tool

# Run the executable JAR file with dependencies
java -jar target/CVE202555182GUI-1.0-SNAPSHOT-jar-with-dependencies.jar

Usage

Vulnerability Detection

1. Enter one or more target URLs in the "Target URL" text box (one per line)
2. Or click the "Import File" button to select a file containing a list of URLs
3. Click the "Start Scan" button to begin scanning
4. Scan results will be displayed in the "Scan Results" area below
5. Click the "Stop Scan" button to interrupt the scanning process

Command Execution

1. Enter the target URL
2. Enter the command to execute
3. Select the target operating system (auto/linux/windows)
4. Click the "Execute Command" button
5. Command execution results will be displayed in the "Execution Results" area below

Web Shell Injection

1. Enter the target URL
2. Select the web shell type (Simple Command Execution / Godzilla Web Shell)
3. Select the target operating system (auto/linux/windows)
4. Click the "Inject Web Shell" button
5. Injection results and connection information will be displayed in the "Injection Results" area below

Reverse Shell

1. Enter the target URL
2. Enter the reverse IP and port
3. Select the target operating system (linux/windows)
4. Optional: Enter a custom reverse shell command
5. Click the "Inject Reverse Shell" button
6. Injection results will be displayed in the "Injection Results" area below

Vulnerability Principle

CVE-2025-55182 is a security flaw in the Next.js framework caused by improper handling of specific requests. Attackers can execute arbitrary commands on the server by constructing malicious multipart/form-data requests.

The tool detects the vulnerability through the following steps:

1. Construct a request containing the command execution payload
2. Send it to the /_next/data path of the target server
3. Check if the response contains the expected command execution result
4. Determine if the vulnerability exists based on the result

Reference Projects

This project references the following open-source projects:

• ReactExploitGUI - Provides the core ideas and implementation methods for vulnerability exploitation

Security Notice

• This tool is intended for security testing and authorized penetration testing only
• Comply with all applicable laws and regulations when using this tool
• Do not use this tool against unauthorized targets
• After testing, promptly clean up injected web shells

Notes

1. Scan speed: Default uses 10 concurrent threads, adjustable based on network conditions
2. Timeout setting: Default timeout is 10 seconds, adjustable based on network conditions
3. Web shell connection: When using Godzilla web shells, you need to download the corresponding Node.js connection plugin
4. Reverse shell: You need to start the corresponding listening port locally (e.g., nc -lvvp 4444)

Troubleshooting

Common Issues and Solutions

1. Scan progress bar stuck

   • Check if the target URL is correct
   • Check if the network connection is normal
   • Try reducing the number of concurrent threads

2. Command execution failed

   • Confirm the target is vulnerable
   • Confirm the correct operating system selection
   • Check if the command syntax matches the target system

3. Web shell injection failed

   • Confirm the target is vulnerable
   • Check if the network connection is stable
   • Try using a different type of web shell

4. Reverse shell connection failed

   • Confirm the local listening port is started
   • Check network firewall settings
   • Confirm the reverse IP and port settings are correct
   • Try using a custom reverse shell command

Version History

• v1.0.0: Initial release
  • Basic vulnerability detection functionality
  • Command execution functionality
  • Web shell injection functionality
  • Reverse shell functionality

Disclaimer

This tool is for educational and authorized security testing purposes only. Do not use it for illegal activities. Any consequences arising from the use of this tool are the sole responsibility of the user.

Contact

For issues or suggestions, feel free to contact the author.