poc-cve-2025-55182

This repository contains a POC of CVE-2025-55182, a critical (CVSS score 10.0) pre-authentication remote code execution vulnerability affecting React Server Components, also known as React2Shell.

The vulnerability stems from how React Server Components deserialize Flight protocol payloads. When processing module references, the code uses bracket notation to access properties (moduleExports[metadata[2]]), which traverses the entire JavaScript prototype chain. This allows attackers to reference properties that weren't explicitly exported, including the constructor property, which provides access to the global Function constructor.

By chaining prototype pollution techniques with React's internal chunk processing mechanisms, an attacker can construct a payload that ultimately executes arbitrary code through the Function constructor.

Prerequisites

• Burp Suite Community or Professional (or any HTTP proxy/client)
• A vulnerable version of React.js or Next.js

Setup Instructions

Step 1: Create a Vulnerable Project

Create a new project using a version that includes the vulnerable React Server Components:

Or use that repository.

Step 2: Create a Test Environment File

Create a .env.local file in the project root to demonstrate the impact of the vulnerability:

Step 3: Start the Development Server

Launch the Next.js development server:

The server should start on http://localhost:3000.

Exploitation Steps

Step 4: Send the Malicious Payload

1. In Burp Suite, go to the Repeater tab
2. Set the target URL to http://localhost:3000/
3. Copy and paste the entire payload into the request window
4. Send

Step 5: Analyze the Response

The response should contain the contents of your .env.local file in the response body:

Payload

The payload consists of three multipart form fields:

Field 0: A fake chunk object containing:

• Prototype pollution references ($1:__proto__:then)
• A Blob reference ($B1337) that triggers the exploit
• A polluted _response object with malicious _prefix and _formData.get

Field 1: A reference to field 0 ($@0)

Field 2: An empty array ([])

The malicious code in _prefix reads .env.local using Node.js's child_process.execSync and embeds the result in an error digest.

Impact

This vulnerability allows attackers to:

• Execute arbitrary code on the server
• Read sensitive files (environment variables, configuration files, etc.)
• Establish reverse shells
• Exfiltrate data
• Perform any operation the Node.js process has permissions to execute

References

• CVE-2025-55182 Details
• Next.js-RSC-RCE-Scanner-CVE-2025-66478
• React Security Advisory
• Facebook Security Advisory
• CISA Known Exploited Vulnerabilities Catalog
• react2shellcve202555182

Practice this CVE in a real-world scenario

Want to exploit CVE-2025-55182 in a hands-on CTF environment? Check out OSS OopsSec Store, a deliberately vulnerable lab designed for offensive security training. This CVE is implemented as one of the flags!

Disclaimer

This proof of concept is provided for educational purposes and security research only. Always ensure you have explicit written permission before testing security vulnerabilities on any system.