CVE-2025-55182 - Next.js/React Server Components Remote Code Execution

Overview

This repository contains a Proof-of-Concept (PoC) exploit for CVE-2025-55182, a critical Remote Code Execution (RCE) vulnerability affecting React Server Components in React versions 19.x and Next.js versions 15.x and 16.x when using the App Router. The vulnerability has a CVSS score of 10.0, representing a severe risk.

Vulnerability Description

The core of the vulnerability lies in the improper handling of deserialization within React Server Components. Specifically, the exploit leverages the @ deserialization to manipulate a Chunk object and hijack its then property. By setting the status to RESOLVED_MODEL, the initializeModelChunk function is called with a fake chunk entirely controlled by the attacker. This allows manipulation of the _response object, ultimately leading to arbitrary code execution.

The exploit targets the Blob deserialization process, specifically the response._formData.get call, to inject attacker-controlled code that is then executed.

Proof-of-Concept (PoC)

The exploit.py script provides a PoC that demonstrates the vulnerability. It crafts a malicious payload that manipulates the deserialization process to execute a command on the target server.

How it Works:

1. @ Deserialization: The exploit uses the @ deserialization mechanism to gain control of a Chunk object.
2. Hijacking Chunk.prototype.then: The then property of the Chunk prototype is overwritten, so when the chunk is awaited/resolved, attacker controlled code will be called.
3. RESOLVED_MODEL Status: Setting the chunk status to RESOLVED_MODEL triggers the initializeModelChunk function, which interacts with the attacker-controlled _response object.
4. _formData.get Manipulation: The exploit manipulates response._formData.get to return a function with attacker-controlled code. This function is then executed.

Prerequisites

• Python 3: The PoC script is written in Python 3.
• Library: Install the library using pip install -r requirements.txt.
• Target Server: A vulnerable Next.js (16.0.6) application running with the App Router.

Usage

1. Save the script: Save the provided Python code as exploit.py.

2. Run the script: Execute the script from the command line, providing the target URL and the command to execute as arguments:

   root@kitploit:~

   python exploit.py <target_url> <command_to_execute>
   

   For example:

   root@kitploit:~

   python exploit.py http://localhost:3000 "ls -l"
   

Demonstration

Disclaimer

This PoC is provided "as is" without any warranty. The author is not responsible for any misuse or damage caused by this script. Use it at your own risk.