hyan0116/next.js-rce-cve-2025-55182next.js rce exploit
Professional security assessment utility for Next.js applications
This tool is intended for authorized security testing and research purposes only.
By using this software, you agree to comply with all applicable laws and regulations.
This utility provides security professionals with a graphical interface for testing Next.js applications against CVE-2025-55182. It helps organizations identify potential security issues in their React Server Components (RSC) implementations.
CVE-2025-55182 is a security issue affecting certain versions of Next.js framework. This tool helps security teams:
| Feature | Description |
|---|---|
| 🎯 Targeted Testing | Precise vulnerability assessment |
| 🛡️ Safety Checks | Built-in protections for sensitive domains |
| 🌐 Proxy Support | Route through SOCKS5/HTTP proxies |
| 📊 Detailed Reports | Comprehensive assessment results |
| 🖥️ GUI Interface | User-friendly Fyne-based interface |
The tool includes responsible disclosure features:
// Automatically blocks testing against:
// - Government domains (.gov)
// - Educational institutions (.edu)
// - Specific geographic regions
follow the steps below. macOS users also have the option of using the convenient DMG file.
# Clone the repository
git clone https://github.com/ssmvl2/Nextjs-RCE-Exploit.git
cd Nextjs-RCE-Exploit
# Install dependencies
go mod download
# Build the application
go build -o nextjs-scanner .
# Run
./nextjs-scanner
# Windows
GOOS=windows GOARCH=amd64 go build -o nextjs-scanner.exe .
# Linux
GOOS=linux GOARCH=amd64 go build -o nextjs-scanner-linux .
# macOS
GOOS=darwin GOARCH=amd64 go build -o nextjs-scanner-mac .
./nextjs-scanner
The application provides an intuitive graphical interface:
┌─────────────────────────────────────────────────────────────┐
│ Next.js Security Assessment Tool │
├─────────────────────────────────────────────────────────────┤
│ │
│ Target URL: [https://example.com________________] │
│ │
│ ☐ Enable Proxy Proxy: [127.0.0.1:8080________] │
│ ☐ Verify SSL Timeout: [30 seconds__________] │
│ ☐ WAF Bypass Mode │
│ │
│ ┌───────────────────────────────────────────────────────┐ │
│ │ Assessment Log: │ │
│ │ [2025-01-15 10:30:15] Starting assessment... │ │
│ │ [2025-01-15 10:30:16] Connecting to target... │ │
│ │ [2025-01-15 10:30:17] Analyzing response... │ │
│ └───────────────────────────────────────────────────────┘ │
│ │
│ [ Start Assessment ] [ Generate Report ] │
│ │
└─────────────────────────────────────────────────────────────┘
| Option | Description | Default |
|---|---|---|
| Target URL | Next.js application URL | Required |
| Enable Proxy | Route through proxy | Disabled |
| Verify SSL | Validate certificates | Enabled |
| Timeout | Request timeout | 30 seconds |
| WAF Bypass | Unicode encoding mode | Disabled |
Nextjs-Security-Tool/
├── main.go # Application entry point & GUI
├── go.mod # Go module definition
├── go.sum # Dependency checksums
└── README.md # Documentation
type RequestHandler struct {
httpClient *http.Client
requestTimeout time.Duration
sslVerify bool
browserAgent string
}
type PayloadResponse struct {
Success bool `json:"success"`
Result string `json:"result"`
Error string `json:"error,omitempty"`
}
| Package | Purpose |
|---|---|
fyne.io/fyne/v2 | Cross-platform GUI framework |
net/http | HTTP client functionality |
crypto/tls | TLS/SSL support |
encoding/json | JSON parsing |
// HTTP Proxy
handler.ConfigureProxy(true, "http://127.0.0.1:8080")
// SOCKS5 Proxy
handler.ConfigureProxy(true, "socks5://127.0.0.1:1080")
The tool uses a realistic browser user agent:
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
If you discover security issues using this tool:
This tool is provided for educational and authorized security testing purposes only. Users are responsible for:
The authors assume no liability for misuse of this software.
Contributions are welcome for:
Please submit issues and pull requests through GitHub.
This project is licensed under the MIT License. See LICENSE for details.
Built for Security Professionals
🔒 Test Responsibly 🔒