l0lsec/cve-2025-55182-labIntentionally vulnerable Next.js RSC Docker lab for CVE-2025-55182 (React2Shell) local testing
Local Docker lab for authorized security research: React Server Components / Next.js App Router with a stack in the CVE-2025-55182 (React2Shell) affected range.
Use only on your own machine. Do not expose this container to the internet.
| Component | Version | Note |
|---|
| Next.js | 15.1.0 | Pre-patch; npm warns about known issues |
| React / react-dom | 19.2.0 | In the affected 19.x line for this CVE |
| RSC pipeline | Bundled in Next | Deserialization is exercised via Next’s compiled react-server-dom-* |
The app is a minimal App Router page with one Server Action so POST / with a Next-Action header behaves like a real target.
git clone https://github.com/l0lsec/cve-2025-55182-lab.git
cd cve-2025-55182-lab
# Build and run in the background
docker compose up --build -d
Open http://localhost:3000 — you should see “RSC lab (intentionally vulnerable)” and a small form.
curl -sS -o /dev/null -w "%{http_code}\n" http://127.0.0.1:3000/
# expect: 200
docker compose logs -f
docker compose down
http://localhost:3000 (or tunnel through Burp).POST / with Content-Type: multipart/form-data and your Flight-protocol exploit body (multipart fields 0, 1, 2 as in public write-ups / your templates).Next-Action header
Next-Action value from that request, orExample header shape:
Next-Action: <action-id-from-intercepted-request>
If a generic placeholder does not work, always prefer the live id from Proxy history after one legitimate submit.
Ready-to-paste POST / multipart templates live in burp-payloads/ (e.g. id, whoami, time-based sleep, OOB placeholders). See burp-payloads/README.md for a file index. Replace YOUR-COLLABORATOR-HOST in OOB templates before sending.
.
├── Dockerfile # Multi-stage build, Next standalone, port 3000
├── docker-compose.yml # Maps host 3000 → container 3000
├── burp-payloads/ # Raw *.http for Burp Repeater + index README
├── app/
│ ├── layout.tsx
│ └── page.tsx # Server Action + lab UI
├── public/
├── package.json
├── package-lock.json
└── next.config.ts # output: "standalone"
npm install
npm run dev
# http://localhost:3000
For CVE reproduction, prefer the Docker image so the stack matches the pinned vulnerable dependencies.
Educational / lab use only. You are responsible for complying with laws and policies where you operate. No warranty.