NSE_CVE-2025-55182

Nmap NSE script for scanning React2Shell (CVE-2025-55182)

Disclaimer The following code is provided for educational and research purposes only. Any use of this script is solely at the discretion and responsibility of the user.

This scanner may produce false positives or inconclusive results, and therefore it is the user’s duty to validate and confirm any reported findings. The author assumes no liability for misuse, damage, or unintended consequences arising from the execution of this code.

Use this tool only in environments where you have explicit authorization. Unauthorized testing of systems is strictly prohibited and may be illegal.

React2Shell (CVE-2025-55182) Remote Code Execution Detection Script

Author: Kevin Leon
Categories: discovery, vuln, intrusive Script Type: Nmap NSE

Usage

nmap --script http-vuln-cve2025-55182.nse -p- <target>

nmap --script http-vuln-cve2025-55182.nse -p3000,3001,3002 <target>

nmap --script http-vuln-cve2025-55182.nse \
     --script-args=http-vuln-cve2025-55182.waf_bypass=true <target>

Output Example

PORT     STATE SERVICE
3000/tcp open  ppp
| http-vuln-cve2025-55182:
|   VULNERABLE:
|   React2Shell Remote Code Execution (RCE)
|     State: VULNERABLE
|     IDs:  CVE:2025-55182
|     Risk factor: High  CVSS: 10.0
|     Disclosure date: 2025-12-03
|     References:
|       https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components
|       https://nvd.nist.gov/vuln/detail/CVE-2025-55182
|       https://github.com/assetnote/react2shell-scanner
|_      https://github.com/msanft/CVE-2025-55182

Framework Detection Phase

Before attempting exploitation, the script verifies that the target is likely running:

• Next.js
• React Server Components

Detection methods

The script performs an initial:

http.get(host, port, "/")

and inspects:

1. Response headers Looking for:

• X-Powered-By: next.js
• X-Powered-By: react

2. HTML body indicators If the body contains:

• _next (indicative of Next.js static assets)

Then the target is considered a potentially vulnerable.

Boundary and Payload Construction

Multipart Boundary Generation

The script generates a randomized WebKit-form boundary:

----WebKitFormBoundary<random 16 chars>

This is used for the multipart/form-data exploit.

Two Payload Modes

Depending on user arguments:

1. Simple Exploit Payload

   • Default mode
   • Minimal payload to trigger deserialization

2. WAF Bypass Payload

   • Activated via:

--script-args=http-vuln-cve2025-55182.waf_bypass=true

Includes more fields and obfuscation to bypass middleware.

Embedded RCE Payload

Inside the payload, the script injects:

process.mainModule.require('child_process')
  .execSync('echo $((41*271))')

This command evaluates to 11111 and is later used to verify exploitation through redirect digest detection.

Exploitation Phase

The script attempts to exploit the vulnerability by POSTing the crafted payload to several known RSC endpoints:

/
/_action
/api/action
/api
/_next/data
/__rsc
/action
/server
/server/action

Each request is sent as:

http.post(host, port, path, header, payload)

Expected exploitation signs

Case A — HTTP 500 Server Error

A successful deserialization failure indicates possible vulnerability:

• Server attempted to dispatch the payload
• Internal error occurred (typical for React2Shell)

Case B — Presence of NEXT_REDIRECT Digest

The payload forces a server-side redirect:

NEXT_REDIRECT;push;/login?a=11111;307;

The script checks response headers for:

• x-action-redirect
• Redirection containing the known value 11111

If found → Highly likely vulnerable

Vulnerability Reporting

Based on the detection outcome, the script fills a standard NSE vulnerability report:

• CVE
• CVSS score (10.0)
• Description
• References
• State:
  • VULNERABLE
  • NOT_VULN

Diagram: Full Detection & Exploitation Flow

 ┌──────────────────────┐
 │ Start NSE Script     │
 └─────────────┬────────┘
               │
               ▼
    ┌────────────────────┐
    │ Request "/"        │
    │ Check headers/body │
    └──────────┬─────────┘
               │Yes
               ▼
    ┌────────────────────┐
    │ React/Next.js Detected? ── No ─▶ Exit (Not Vulnerable)
    └──────────┬─────────┘
               │Yes
               ▼
    ┌────────────────────┐
    │ Build multipart     │
    │ exploit payload     │
    └──────────┬─────────┘
               ▼
    ┌─────────────────────────────────┐
    │ Loop through RSC endpoints      │
    │ Send POST exploit payload       │
    └──────────┬──────────────────────┘
               │
     ┌─────────┴──────────────────────────────┐
     ▼                                        ▼
┌───────────────┐                     ┌───────────────────┐
│ HTTP 500?      │ YES               │ Redirect digest?   │ YES
└───────┬────────┘                     └────────┬──────────┘
        │NO                                     │NO
        ▼                                        ▼
   Continue testing                     Continue testing
         │                                        │
         └──────────────────────────────┬─────────┘
                                        ▼
                              ┌────────────────────┐
                              │ Vulnerable?        │
                              └──────────┬─────────┘
                                         ▼
                                 Generate Report

Key Technical Features

• Detection of multiple frameworks (React/Next.js)
• Random boundary generation for realistic multipart requests
• Two exploit modes (simple & WAF bypass)
• Multiple endpoint probing
• Checks for specific RCE side effects (redirect digest)
• Integration with Nmap vulns library
• Non-intrusive safe exploitation (no destructive commands)

Conclusion

This script provides a thorough, automated, and safe detection mechanism for the high-impact React2Shell vulnerability. Its layered validation approach ensures reliable detection while minimizing false positives.