fatguru/cve-2025-55182-scannerA non-intrusive surface scanner for CVE-2025-55182 (React Server Components RCE). Detects exposed RSC endpoints in React 19 and Next.js applications
A specialized, non-intrusive surface detector for CVE-2025-55182 (React Server Components RCE).
Read this before scanning:
While CVE-2025-55182 is a critical RCE vulnerability (CVSS 10.0), real-world exploitation in Next.js production environments is conditional.
serverManifest to whitelist allowed modules. Direct attempts to load dangerous modules (like child_process) via RSC often fail because they are not in this manifest.serverManifest in memory and bypass the whitelist.742 instead of "vm"). Rigid exploits guessing names will fail (False Negatives).This tool is a Surface Detector. It identifies if the RSC protocol is exposed and active. Finding an exposed endpoint is the prerequisite step to identifying the attack surface where a Prototype Pollution chain could be attempted.
Most public PoCs and scanners result in False Negatives in production environments because they fall into four common traps:
Exploit Rigidity: They try to execute specific gadgets (like vm or child_process) which are blocked by whitelists, or rely on hardcoded IDs (e.g., "id":"vm") that fail against minified Webpack builds.
Root Redirects: Hitting POST / on Next.js often triggers a 307/308 redirect (e.g., to /login), causing the POST body to be lost or converted to GET before the server processes it.
Transport Mismatch: Many scanners send payloads as text/plain or raw JSON. Strict Next.js Server Actions often require multipart/form-data encapsulation. If the format is wrong, the server returns 404/200 without ever triggering the vulnerable parser.
WAF Blindness: Standard tools see a 403 Forbidden and give up. They fail to distinguish between a global IP block and a specific rule filter, missing opportunities to bypass the WAF using encoding or padding techniques.
This scanner solves all three challenges:
✅ Smart Path Probing: Automatically probes random non-existent paths (e.g., /x7z9q2) to bypass root redirects (307/308) and force the Next.js App Router to process the request context.
✅ Strict Transport (Multipart): Uses multipart/form-data encapsulation instead of plain text. This resolves False Negatives on strict Server Action endpoints that otherwise return 404s.
✅ WAF Differential Analysis: Distinguishes between global blocks ([BLOCKED]) and specific rule filtering ([FILTERED]). If the backend allows the protocol but blocks the payload, the scanner identifies it as a high-value target.
✅ Auto-Bypass Mode: Includes an optional --bypass engine that automatically attempts evasion techniques (Unicode escapes, Whitespace mutation, Junk Padding) against [FILTERED] targets.
✅ Hardened Detection: Catches "Silent Crashes" ([SUSPICIOUS]) on enterprise servers that strip X-Powered-By headers, and identifies the Assetnote 303 See Other redirect fingerprint.
✅ Active Fingerprinting: Uses a specialized payload (["$1:aa:aa"]) to trigger the unique React 19 RSC "Digest" error, confirming the parser is active even without a full RCE.
Clone the repository:
git clone https://github.com/fatguru/CVE-2025-55182-scanner.git
cd CVE-2025-55182-scanner
Install dependencies (recommended in a virtual environment):
pip install -r requirements.txt
Basic Scan
Check a single URL. Note: Ensure you point to the correct application path (e.g., /dashboard, /login), not just the root domain, as Next.js App Router endpoints are path-specific.
python3 cve_2025_55182_scanner.py -u http://localhost:3000/dashboard
Bulk Scan
Scan a list of URLs from a file (one URL per line). This is the recommended strategy to avoid missing specific paths.
python3 cve_2025_55182_scanner.py -l targets.txt -o results.csv
Ignore SSL/TLS certificate errors (useful for IP-based scanning, local labs, or self-signed certs).
python3 cve_2025_55182_scanner.py -u [https://192.168.1.50](https://192.168.1.50) -k
New in v2.1: Use the --header flag to pass session cookies or tokens if the app is behind authentication or a WAF that requires specific headers.
python3 cve_2025_55182_scanner.py -u https://target.com --header "Cookie: session=123" --header "Authorization: Bearer xyz"
| Flag | Description |
|---|---|
-u, --url | Single target URL (e.g., http://target.com/dashboard). |
-l, --list | File containing a list of URLs to scan (one per line). |
--bypass | (New v2.5) Enable WAF Evasion mode. Automatically attempts mutation techniques (Unicode, Padding, Whitespace) if a target is detected as [FILTERED]. |
--header | Add custom headers (e.g., Cookie: session=xyz, Authorization: Bearer...). Can be used multiple times. |
-o, --output | Save results to a text file. |
-k, --insecure | Disable TLS certificate verification (Suppress SSL warnings). |
-t, --threads | Number of concurrent threads for bulk scanning (default: 10). |
--timeout | Request timeout in seconds (default: 10s to accommodate multipart payloads). |
--verbose | Enable debug mode. Shows detailed probing steps, WAF blocking status, and bypass attempts. |
📊 Interpreting Results (v2.5)
[EXPOSED] | 🔴 (Red) | Vulnerable
The server processed the payload and returned a React 19 digest error OR an Action Redirect (303). High confidence of exposed surface.
[BYPASSED] | 🟠 (Orange) | WAF Evaded
Success! The scanner initially detected a filter, but successfully evaded it using mutation techniques (e.g., Padding/Unicode) to trigger the vulnerability.
[SUSPICIOUS] | 🟡 (Yellow) | Warning
The server crashed (500) while parsing the payload. Indicates exposed serialization logic, even on hardened targets that strip X-Powered-By headers.
[FILTERED] | 🔵 (Blue) | WAF Rule Detected
The server accepts RSC traffic (Benign payload passed), but a specific WAF rule blocked the exploit payload. The target is alive behind the WAF. Use --bypass to attempt evasion.
[INFO] | 🔵 (Cyan) | Protocol Detected
The server speaks RSC (text/x-component) but handled the payload gracefully. Likely patched or standard behavior.
[BLOCKED] | 🟣 (Magenta) | Global WAF Block
Everything was blocked (403/406), including the benign handshake. The WAF is blocking the protocol entirely or your IP.
[SAFE] | 🟢 (Green) | Clean
Server returned 404/200 but ignored RSC headers/multipart bodies on all probed paths.
A Nuclei template based on this detection logic is included in this repository: cve-2025-55182-detection.yaml.
nuclei -t cve-2025-55182-detection.yaml -l targets.txt