harness-security-labs/cve-2025-55182-checkerMulti-technique vulnerability detector for CVE-2025-55182 in React/Next.js applications. Tests gadget chains, RCE payloads, and WAF bypass variants to identify vulnerable Server Actions endpoints.
A comprehensive vulnerability detection tool for CVE-2025-55182 in React/Next.js applications with multiple detection techniques.
FOR AUTHORIZED SECURITY TESTING AND RESEARCH PURPOSES ONLY
This tool is designed for:
Unauthorized access to computer systems is illegal. Always obtain written permission before testing.
This detector comprehensively tests if a target application is vulnerable to CVE-2025-55182 using multiple techniques:
The tool tests Node.js gadget chains with harmless operations:
1+1)echo test)path)/dev/null)Testing Operations:
echo test, 1+1)/dev/null)Does NOT:
This tool uses uv for dependency management and execution.
No installation needed! Just clone and run:
git clone <repository-url>
cd CVE-2025-55182/poc
uv run check http://target.com:3000
The tool will automatically install dependencies on first run.
uv run check <target_url>
# Test a target with default settings (tests /formaction endpoint)
uv run check http://localhost:3002
# Specify custom endpoint
uv run check http://localhost:3002 --endpoint /api/formaction
# Test multiple targets from a file
uv run check --file targets.txt
# Save vulnerable hosts to file
uv run check --file targets.txt -o vulnerable.txt
# Increase timeout for slow connections
uv run check http://localhost:3002 --timeout 15
# Disable SSL verification (for self-signed certificates)
uv run check http://localhost:3002 --no-ssl-verify
# Quiet mode (minimal output)
uv run check http://localhost:3002 --quiet
usage: uv run check [-h] [-f FILE] [-e ENDPOINT] [-t TIMEOUT]
[--no-ssl-verify] [-q] [-o OUTPUT] [target]
positional arguments:
target Target URL (e.g., http://target.com:3000)
optional arguments:
-h, --help Show help message and exit
-f, --file FILE File containing target URLs (one per line)
-e, --endpoint API endpoint path (default: /formaction)
-t, --timeout Request timeout in seconds (default: 10)
--no-ssl-verify Disable SSL certificate verification
-q, --quiet Quiet mode (minimal output)
-o, --output OUTPUT Output file to write vulnerable hosts
0 - Target is NOT vulnerable1 - Target IS vulnerable130 - User interrupted (Ctrl+C)# uv run check http://localhost:3002
======================================================================
CVE-2025-55182 Vulnerability Detector - Enhanced Edition
Multiple Detection Techniques | Comprehensive Coverage
======================================================================
[*] Testing http://localhost:3002/formaction
[*] Testing all detection techniques...
→ Gadget: fs#constructor: ✓ VULNERABLE
→ Gadget: vm#runInThisContext: ✓ VULNERABLE
→ Gadget: child_process#execSync: ✓ VULNERABLE
→ Gadget: module#_load: ✓ VULNERABLE
→ Gadget: fs#readFileSync: ✓ VULNERABLE
→ Gadget: util#promisify: ✗ Not vulnerable
→ Safe Side-Channel Detection: ✗ Not vulnerable
→ RCE PoC (Unix/Linux): ✗ Not vulnerable
→ RCE PoC (Windows): ✗ Not vulnerable
→ RCE with WAF Bypass (Unix/Linux): ✗ Not vulnerable
→ RCE with WAF Bypass (Windows): ✗ Not vulnerable
→ Advanced WAF Bypass (Unix/Linux): ✗ Not vulnerable
======================================================================
DETECTION RESULTS
======================================================================
Target: http://localhost:3002
Endpoint: /formaction
Techniques Tested: Multiple
Successful Techniques: 5 techniques detected vulnerability
Status: ⚠️ VULNERABLE
The target appears to be vulnerable to CVE-2025-55182.
Techniques that detected vulnerability:
-> Gadget: fs#constructor
-> Gadget: vm#runInThisContext
-> Gadget: child_process#execSync
-> Gadget: module#_load
-> Gadget: fs#readFileSync
Recommendation: Apply security patches immediately.
======================================================================
# uv run check http://localhost:8000
======================================================================
CVE-2025-55182 Vulnerability Detector - Enhanced Edition
Multiple Detection Techniques | Comprehensive Coverage
======================================================================
[*] Testing http://localhost:8000/formaction
[*] Testing all detection techniques...
→ Gadget: fs#constructor: ✗ Not vulnerable
→ Gadget: vm#runInThisContext: ✗ Not vulnerable
→ Gadget: child_process#execSync: ✗ Not vulnerable
→ Gadget: module#_load: ✗ Not vulnerable
→ Gadget: fs#readFileSync: ✗ Not vulnerable
→ Gadget: util#promisify: ✗ Not vulnerable
→ Safe Side-Channel Detection: ✗ Not vulnerable
→ RCE PoC (Unix/Linux): ✗ Not vulnerable
→ RCE PoC (Windows): ✗ Not vulnerable
→ RCE with WAF Bypass (Unix/Linux): ✗ Not vulnerable
→ RCE with WAF Bypass (Windows): ✗ Not vulnerable
→ Advanced WAF Bypass (Unix/Linux): ✗ Not vulnerable
======================================================================
DETECTION RESULTS
======================================================================
Target: http://localhost:8000
Endpoint: /formaction
Techniques Tested: Multiple
Status: ✓ NOT VULNERABLE
The target does not appear to be vulnerable to CVE-2025-55182.
All detection techniques failed to confirm vulnerability.
======================================================================
The script allows you to test multiple hosts at once.
# Create a file with target URLs (one per line)
echo "http://localhost:3002" > targets.txt
echo "http://localhost:8000" >> targets.txt
# Run batch scan
uv run check --file targets.txt -o vulnerable.txt
Output:
======================================================================
CVE-2025-55182 Vulnerability Detector - Enhanced Edition
Multiple Detection Techniques | Comprehensive Coverage
======================================================================
[*] Loaded 2 target(s) from file
[*] Testing target 1/2
[*] Testing http://localhost:3002/formaction
[*] Testing all detection techniques...
→ Gadget: fs#constructor: ✓ VULNERABLE
→ Gadget: vm#runInThisContext: ✓ VULNERABLE
[... additional techniques ...]
======================================================================
DETECTION RESULTS
======================================================================
Target: http://localhost:3002
Endpoint: /formaction
Techniques Tested: Multiple
Successful Techniques: 5 techniques detected vulnerability
Status: ⚠️ VULNERABLE
[... details ...]
======================================================================
[*] Testing target 2/2
[*] Testing http://localhost:8000/formaction
[*] Testing all detection techniques...
→ Gadget: fs#constructor: ✗ Not vulnerable
[... all techniques fail ...]
----------------------------------------------------------------------
Target: http://localhost:8000
Endpoint: /formaction
Techniques Tested: Multiple
Status: ✓ NOT VULNERABLE
----------------------------------------------------------------------
======================================================================
SUMMARY
======================================================================
Total targets tested: 2
Vulnerable: 1
Not vulnerable: 1
======================================================================
[+] Wrote 1 vulnerable host(s) to vulnerable.txt
These techniques test if specific Node.js modules and functions are accessible through the vulnerability. All use safe, non-destructive operations:
1+1echo testpath module/dev/null (safe system file)echo $((41*271))41*271Different environments may block certain approaches while allowing others:
child_process but allow vm moduleCVE-2025-55182 is a vulnerability affecting certain React/Next.js applications that use Server Actions. The vulnerability allows attackers to execute arbitrary code on the server through unsafe deserialization of user-controlled data.
$ACTION_* fieldsIf you discover vulnerabilities using this tool:
For issues, questions, or improvements, please refer to the main project documentation.
This tool is provided for educational and authorized security testing purposes only.
Remember: With great power comes great responsibility. Use this tool ethically and legally.