CVE-2025-55182 — PoC, Hunting React2Shell about CVE-2025-55182 | Kitploit

Hunting for CVE-2025-55182

Using Open Source Intelligence to Identify Vulnerable (Shodan Search Engine)

Go to Shodan.
In the search bar, enter the following query to find devices running the vulnerable version of the Next.js framework:
```
http.component:"Next.js" 200
```

alt text

Download in the terminal the results of the search using the Shodan CLI:
```
shodan download nextjs_vuln "http.component:'Next.js' 200"
```

alt text

Filter the results to identify domains, ips are running the vulnerable version of Next.js:

shodan parse --fields ip_str nextjs_data.json.gz > ips.txt
shodan parse --fields hostnames nextjs_data.json.gz > domains.txt

Verifying Vulnerability (Using this PoC scanner script react2shell-scanner)

alt text

PoC Exploit

I created a simple PoC exploit to demonstrate the vulnerability. You can find it here.

alt text

Using nuclei to scan for the vulnerability:

cat domains.txt | nuclei -t ./nuclei-templates/http/cves/2025/CVE-2025-55182.yaml

alt text

References