CVE-2025-55182 Vulnerability Detector - Enhanced Edition

A comprehensive vulnerability detection tool for CVE-2025-55182 in React/Next.js applications with multiple detection techniques.

⚠️ Legal Disclaimer

FOR AUTHORIZED SECURITY TESTING AND RESEARCH PURPOSES ONLY

This tool is designed for:

• Authorized penetration testing engagements
• Security research in controlled environments
• Educational purposes
• Vulnerability assessment with proper authorization

Unauthorized access to computer systems is illegal. Always obtain written permission before testing.

Features

• Multiple Detection Techniques: Comprehensive testing with various approaches
• Gadget Chain Probes: Tests various Node.js module access paths
• Safe Operations: Uses only harmless, non-destructive test commands
• WAF Bypass Techniques: Advanced detection for protected environments
• Batch Testing: Test multiple targets from a file

What This Script Does

This detector comprehensively tests if a target application is vulnerable to CVE-2025-55182 using multiple techniques:

✅ Gadget Chain Probes (Safe, Non-Destructive)

The tool tests Node.js gadget chains with harmless operations:

• fs#constructor: Tests filesystem constructor access (no files accessed)
• vm#runInThisContext: Evaluates safe JavaScript (1+1)
• child_process#execSync: Executes harmless command (echo test)
• module#_load: Loads safe built-in module (path)
• fs#readFileSync: Reads safe system file (/dev/null)
• util#promisify: Tests utility function access

✅ Enhanced Detection Techniques

• Safe Side-Channel Detection: Non-exploitative error pattern detection
• RCE Proof-of-Concept: Command execution tests (Unix/Linux & Windows)
• WAF Bypass Variants: Techniques to evade web application firewalls
• Advanced Payloads: Multiple payload construction methods

⚠️ What the Tool Does

Testing Operations:

• Executes safe, harmless commands (echo test, 1+1)
• Reads safe system files (/dev/null)
• Tests module loading with built-in modules
• Sends multiple payload variants to detect vulnerability

Does NOT:

• Read sensitive files or data
• Write or modify any files
• Execute destructive commands
• Leave any traces or backdoors
• Exploit the vulnerability beyond detection

Installation

This tool uses uv for dependency management and execution.

Prerequisites

• Python 3.13 or higher
• uv (install from https://github.com/astral-sh/uv)

Quick Start

No installation needed! Just clone and run:

git clone <repository-url>
cd CVE-2025-55182/poc
uv run check http://target.com:3000

The tool will automatically install dependencies on first run.

Usage

Basic Usage

uv run check <target_url>

Examples

# Test a target with default settings (tests /formaction endpoint)
uv run check http://localhost:3002

# Specify custom endpoint
uv run check http://localhost:3002 --endpoint /api/formaction

# Test multiple targets from a file
uv run check --file targets.txt

# Save vulnerable hosts to file
uv run check --file targets.txt -o vulnerable.txt

# Increase timeout for slow connections
uv run check http://localhost:3002 --timeout 15

# Disable SSL verification (for self-signed certificates)
uv run check http://localhost:3002 --no-ssl-verify

# Quiet mode (minimal output)
uv run check http://localhost:3002 --quiet

Command-line Options

usage: uv run check [-h] [-f FILE] [-e ENDPOINT] [-t TIMEOUT]
                    [--no-ssl-verify] [-q] [-o OUTPUT] [target]

positional arguments:
  target                Target URL (e.g., http://target.com:3000)

optional arguments:
  -h, --help            Show help message and exit
  -f, --file FILE       File containing target URLs (one per line)
  -e, --endpoint        API endpoint path (default: /formaction)
  -t, --timeout         Request timeout in seconds (default: 10)
  --no-ssl-verify       Disable SSL certificate verification
  -q, --quiet           Quiet mode (minimal output)
  -o, --output OUTPUT   Output file to write vulnerable hosts

Exit Codes

• 0 - Target is NOT vulnerable
• 1 - Target IS vulnerable
• 130 - User interrupted (Ctrl+C)
• Other - Error occurred

Sample Output

Vulnerable Target

# uv run check http://localhost:3002
======================================================================
CVE-2025-55182 Vulnerability Detector - Enhanced Edition
Multiple Detection Techniques | Comprehensive Coverage
======================================================================

[*] Testing http://localhost:3002/formaction
[*] Testing all detection techniques...
  → Gadget: fs#constructor: ✓ VULNERABLE
  → Gadget: vm#runInThisContext: ✓ VULNERABLE
  → Gadget: child_process#execSync: ✓ VULNERABLE
  → Gadget: module#_load: ✓ VULNERABLE
  → Gadget: fs#readFileSync: ✓ VULNERABLE
  → Gadget: util#promisify: ✗ Not vulnerable
  → Safe Side-Channel Detection: ✗ Not vulnerable
  → RCE PoC (Unix/Linux): ✗ Not vulnerable
  → RCE PoC (Windows): ✗ Not vulnerable
  → RCE with WAF Bypass (Unix/Linux): ✗ Not vulnerable
  → RCE with WAF Bypass (Windows): ✗ Not vulnerable
  → Advanced WAF Bypass (Unix/Linux): ✗ Not vulnerable

======================================================================
DETECTION RESULTS
======================================================================
Target:                  http://localhost:3002
Endpoint:                /formaction
Techniques Tested:       Multiple
Successful Techniques:   5 techniques detected vulnerability

Status:                  ⚠️  VULNERABLE

The target appears to be vulnerable to CVE-2025-55182.

Techniques that detected vulnerability:
 -> Gadget: fs#constructor
 -> Gadget: vm#runInThisContext
 -> Gadget: child_process#execSync
 -> Gadget: module#_load
 -> Gadget: fs#readFileSync

Recommendation: Apply security patches immediately.
======================================================================

Non-Vulnerable Target

# uv run check http://localhost:8000
======================================================================
CVE-2025-55182 Vulnerability Detector - Enhanced Edition
Multiple Detection Techniques | Comprehensive Coverage
======================================================================

[*] Testing http://localhost:8000/formaction
[*] Testing all detection techniques...
  → Gadget: fs#constructor: ✗ Not vulnerable
  → Gadget: vm#runInThisContext: ✗ Not vulnerable
  → Gadget: child_process#execSync: ✗ Not vulnerable
  → Gadget: module#_load: ✗ Not vulnerable
  → Gadget: fs#readFileSync: ✗ Not vulnerable
  → Gadget: util#promisify: ✗ Not vulnerable
  → Safe Side-Channel Detection: ✗ Not vulnerable
  → RCE PoC (Unix/Linux): ✗ Not vulnerable
  → RCE PoC (Windows): ✗ Not vulnerable
  → RCE with WAF Bypass (Unix/Linux): ✗ Not vulnerable
  → RCE with WAF Bypass (Windows): ✗ Not vulnerable
  → Advanced WAF Bypass (Unix/Linux): ✗ Not vulnerable

======================================================================
DETECTION RESULTS
======================================================================
Target:                  http://localhost:8000
Endpoint:                /formaction
Techniques Tested:       Multiple

Status:                  ✓ NOT VULNERABLE

The target does not appear to be vulnerable to CVE-2025-55182.
All detection techniques failed to confirm vulnerability.
======================================================================

Batch Testing

The script allows you to test multiple hosts at once.

# Create a file with target URLs (one per line)
echo "http://localhost:3002" > targets.txt
echo "http://localhost:8000" >> targets.txt

# Run batch scan
uv run check --file targets.txt -o vulnerable.txt