This tool is a Surface Detector. It identifies if the RSC protocol is exposed and active. Finding an exposed endpoint is the prerequisite step to identifying the attack surface where a Prototype Pollution chain could be attempted.

🛡️ Why use this Surface Detector?

• Most public PoCs and scanners result in False Negatives in production environments because they fall into four common traps:

• Exploit Rigidity: They try to execute specific gadgets (like vm or child_process) which are blocked by whitelists, or rely on hardcoded IDs (e.g., "id":"vm") that fail against minified Webpack builds.

• Root Redirects: Hitting POST / on Next.js often triggers a 307/308 redirect (e.g., to /login), causing the POST body to be lost or converted to GET before the server processes it.

• Transport Mismatch: Many scanners send payloads as text/plain or raw JSON. Strict Next.js Server Actions often require multipart/form-data encapsulation. If the format is wrong, the server returns 404/200 without ever triggering the vulnerable parser.

• WAF Blindness: Standard tools see a 403 Forbidden and give up. They fail to distinguish between a global IP block and a specific rule filter, missing opportunities to bypass the WAF using encoding or padding techniques.

This scanner solves all three challenges:

✅ Smart Path Probing: Automatically probes random non-existent paths (e.g., /x7z9q2) to bypass root redirects (307/308) and force the Next.js App Router to process the request context.

✅ Strict Transport (Multipart): Uses multipart/form-data encapsulation instead of plain text. This resolves False Negatives on strict Server Action endpoints that otherwise return 404s.

✅ WAF Differential Analysis: Distinguishes between global blocks ([BLOCKED]) and specific rule filtering ([FILTERED]). If the backend allows the protocol but blocks the payload, the scanner identifies it as a high-value target.

✅ Auto-Bypass Mode: Includes an optional --bypass engine that automatically attempts evasion techniques (Unicode escapes, Whitespace mutation, Junk Padding) against [FILTERED] targets.

✅ Hardened Detection: Catches "Silent Crashes" ([SUSPICIOUS]) on enterprise servers that strip X-Powered-By headers, and identifies the Assetnote 303 See Other redirect fingerprint.

✅ Active Fingerprinting: Uses a specialized payload (["$1:aa:aa"]) to trigger the unique React 19 RSC "Digest" error, confirming the parser is active even without a full RCE.

🚀 Installation

1. Clone the repository:

   root@kitploit:~

   git clone https://github.com/fatguru/CVE-2025-55182-scanner.git
   cd CVE-2025-55182-scanner
   
   

2. Install dependencies (recommended in a virtual environment):

   root@kitploit:~

   pip install -r requirements.txt
   

💻 Usage

Basic Scan

Check a single URL. Note: Ensure you point to the correct application path (e.g., /dashboard, /login), not just the root domain, as Next.js App Router endpoints are path-specific.

Bulk Scan

Scan a list of URLs from a file (one URL per line). This is the recommended strategy to avoid missing specific paths.

Insecure Mode (New)

Ignore SSL/TLS certificate errors (useful for IP-based scanning, local labs, or self-signed certs).

Scan with Custom Headers (WAF Bypass / Auth)

New in v2.1: Use the --header flag to pass session cookies or tokens if the app is behind authentication or a WAF that requires specific headers.

Options

📊 Interpreting Results (v2.5)

[EXPOSED] | 🔴 (Red) | Vulnerable

The server processed the payload and returned a React 19 digest error OR an Action Redirect (303). High confidence of exposed surface.

[BYPASSED] | 🟠 (Orange) | WAF Evaded

Success! The scanner initially detected a filter, but successfully evaded it using mutation techniques (e.g., Padding/Unicode) to trigger the vulnerability.

[SUSPICIOUS] | 🟡 (Yellow) | Warning

The server crashed (500) while parsing the payload. Indicates exposed serialization logic, even on hardened targets that strip X-Powered-By headers.

[FILTERED] | 🔵 (Blue) | WAF Rule Detected

The server accepts RSC traffic (Benign payload passed), but a specific WAF rule blocked the exploit payload. The target is alive behind the WAF. Use --bypass to attempt evasion.

[INFO] | 🔵 (Cyan) | Protocol Detected

The server speaks RSC (text/x-component) but handled the payload gracefully. Likely patched or standard behavior.

[BLOCKED] | 🟣 (Magenta) | Global WAF Block

Everything was blocked (403/406), including the benign handshake. The WAF is blocking the protocol entirely or your IP.

[SAFE] | 🟢 (Green) | Clean

Server returned 404/200 but ignored RSC headers/multipart bodies on all probed paths.

🛠️ Nuclei Template (https://github.com/projectdiscovery/nuclei)

A Nuclei template based on this detection logic is included in this repository: cve-2025-55182-detection.yaml.

v2.5 Changelog (Major Update)

• WAF Bypass Mode: New --bypass flag automates evasion techniques (Whitespace, Unicode, Large Padding) when a target is detected as [FILTERED].
• Multipart Support: Payload transport switched to multipart/form-data to fix False Negatives on targets returning 404s to text payloads.
• Smart Analysis:
  • [FILTERED]: Identifies when a WAF specifically blocks the exploit payload but allows RSC traffic (High value targets).
  • [SUSPICIOUS]: Now catches crashes on hardened servers that hide X-Powered-By headers.
  • [EXPOSED]: Added detection for 303 See Other redirects used by some vulnerable implementations.

v2.2 Changelog (Critical Update)

• False Negative Fix (Multipart): Switched payload transport from text/plain to multipart/form-data. This resolves False Negatives on targets that strictly enforce form data for Server Actions and previously returned 404s.
• Redirect Detection: Logic updated to catch HTTP 303 See Other and x-action-redirect headers, which are strong indicators of RSC processing often hidden when scanners follow redirects automatically.

v2.1 Updates

• False Positive Fix: Logic updated to separate 'Info' (RSC Protocol Detected, likely patched) from 'Suspicious' (Server Crash/500), resolving issues with React 19.x patched versions.
• WAF Detection: Scanner now explicitly identifies and reports [BLOCKED] status (HTTP 403/406) when WAFs intercept the attack signature.
• Header Strategy: Added optional --header argument for custom traffic identification, Authorization, or WAF allow-listing.
• UX Improvements: Fixed ASCII banner, added SSL warning suppression (-k), and robust color handling.

⚖️ Disclaimer

This tool is intended to help security researchers and administrators identify exposed attack surfaces in their own systems. The author is not responsible for any misuse of this tool. Do not use against systems you do not have explicit permission to test.

References: