🥊 PunchingBag - CVE-2025-55182 Security Research Platform

⚠️ EDUCATIONAL PURPOSE ONLY: This is an intentionally vulnerable application designed for authorized security research and CTF challenges. Do NOT use these techniques on unauthorized systems.

A deliberately vulnerable Next.js 15.1.6 application that demonstrates CVE-2025-55182 (React2Shell) - a critical Remote Code Execution vulnerability in React Server Components. Built for security researchers, penetration testers, and students to practice exploitation techniques in a safe, isolated environment.

📋 Table of Contents

• About CVE-2025-55182
• Features
• Prerequisites
• Installation
• Usage
• CTF Challenges
• Exploitation Guide
• Project Structure
• Security Notice
• Contributing
• License
• Acknowledgments

🔍 About CVE-2025-55182

CVE-2025-55182, also known as React2Shell, is a critical Remote Code Execution (RCE) vulnerability affecting React Server Components in Next.js.

Vulnerability Details

• CVE ID: CVE-2025-55182
• Type: Remote Code Execution (RCE)
• CVSS Score: 10.0 (Critical)
• Affected Versions: Next.js 15.1.6 and earlier with React Server Components enabled
• Attack Vector: Unsafe deserialization in RSC Flight protocol
• Impact: Complete system compromise, data exfiltration, privilege escalation

How It Works

The vulnerability stems from improper handling of serialized data in React Server Actions. Attackers can craft malicious payloads that bypass validation and execute arbitrary code on the server through:

1. Prototype pollution in JavaScript objects
2. Unsafe deserialization of React Flight payloads
3. Server Action parameter manipulation
4. Header injection in Server Components

✨ Features

• 🐳 Fully Dockerized - Complete isolation from host system
• 🎯 5 CTF Flags - Progressive difficulty challenges
• 🔓 Multiple Attack Vectors - Server Actions, API routes, authentication bypass
• 📚 Educational Resources - Built-in hints and exploitation guides
• 🛡️ Safe Environment - No risk to production systems
• 🎨 Realistic Application - Realistic app theme with admin panel
• 📊 Progress Tracking - Monitor your flag captures
• 🔧 Vulnerable Version of React and Next.js - React 19.0.0, Next.js 15.1.6

🔧 Prerequisites

Before you begin, ensure you have the following installed:

• Docker: Version 20.10 or higher
• Docker Compose: Version 2.0 or higher
• Git: For cloning the repository

Check Your Installation

docker --version
docker-compose --version
git --version

📦 Installation

Quick Start

# 1. Clone the repository
git clone https://github.com/Machine-farmer/PunchingBag-for-React2Shell.git
cd PunchingBag-for-React2Shell

# 2. Build and run with Docker
docker-compose up --build

# 3. Access the application
# Open your browser to: http://localhost:3000

Manual Setup (Without Docker)

# 1. Clone the repository
git clone https://github.com/Machine-farmer/punchingbag-cve-2025-55182.git
cd punchingbag-cve-2025-55182

# 2. Install dependencies
npm install

# 3. Run development server
npm run dev

# 4. Access at http://localhost:3000

⚠️ Warning: Manual setup without Docker is NOT recommended for security research. Always use Docker for isolation.

🚀 Usage

Starting the Environment

# Start the vulnerable application
docker-compose up

# Start in detached mode (background)
docker-compose up -d

# View logs
docker-compose logs -f

Stopping the Environment

# Stop containers
docker-compose down

# Stop and remove volumes
docker-compose down -v

# Complete cleanup (removes images)
docker-compose down -v --rmi all

Accessing the Application

Once running, navigate to:

• Homepage: http://localhost:3000
• Dashboard: http://localhost:3000/dashboard
• Admin Panel: http://localhost:3000/admin

🎯 CTF Challenges

PunchingBag contains 5 hidden flags that test different exploitation techniques:

Flag Format

All flags follow the format: CTF{description_here}

Hints

• Flag 1: Explore the application structure and dashboard
• Flag 2: Look for Server Actions that accept user input
• Flag 3: Check environment variables for credentials
• Flag 4: Exploit the RCE vulnerability in admin console
• Flag 5: Extract hidden configuration data

🔓 Exploitation Guide

Tools You'll Need

• Burp Suite - HTTP request interception and modification
• curl - Command-line HTTP client for payload crafting
• Browser DevTools - Network traffic inspection
• Postman - API testing (optional)

Basic Exploitation Workflow

1. Reconnaissance

# Explore the application
curl http://localhost:3000

# Check available endpoints
curl http://localhost:3000/dashboard
curl http://localhost:3000/admin

2. Server Action Exploitation

Intercept form submissions and modify the payload:

// Example malicious payload
{
  "name": "attacker",
  "email": "[email protected]",
  "message": "__proto__: { isAdmin: true }"
}

3. Header Injection

# Inject malicious headers
curl -X POST http://localhost:3000/api/data \
  -H "Content-Type: application/json" \
  -H "x-user-data: {\"role\":\"admin\"}" \
  -d '{"exploit": true}'

4. Admin Access

Check .env.local for credentials or exploit the authentication:

# Default admin token (intentionally weak)
Username: admin
Token: super_secret_admin_key_12345

5. Remote Code Execution

On vulnerable component use the command execution feature:

# Simulate RCE
Command: cat /flag.txt

Advanced Techniques

• Prototype Pollution: Inject __proto__ properties
• RSC Payload Crafting: Modify React Flight serialized data
• Session Hijacking: Manipulate authentication tokens
• API Fuzzing: Test all endpoints for vulnerabilities

📁 Project Structure

punchingbag-cve-2025-55182/
├── app/
│   ├── actions.js              # Vulnerable Server Actions
│   ├── layout.js               # Application layout
│   ├── page.js                 # Homepage with CTF info
│   ├── globals.css             # Global styles
│   ├── admin/
│   │   └── page.js            # Admin panel (Flag 3, 4)
│   ├── dashboard/
│   │   └── page.js            # User dashboard (Flag 1, 2)
│   └── api/
│       ├── data/
│       │   └── route.js       # API endpoint
│       └── submit/
│           └── route.js       # Form submission endpoint
├── components/
│   ├── Logo.js                # Application logo
│   ├── VulnerableForm.js      # Exploitable form component
│   └── UserDisplay.js         # User profile display
├── lib/
│   └── flags.js               # Flag management
├── public/
│   └── boxing-bag.png         # Application icon
├── .env.local                 # Environment variables (Flag 5)
├── docker-compose.yml         # Docker configuration
├── Dockerfile                 # Container definition
├── next.config.js             # Next.js configuration
├── package.json               # Dependencies
└── README.md                  # This file

🛡️ Security Notice

⚠️ IMPORTANT DISCLAIMERS

This application is INTENTIONALLY VULNERABLE and designed for:

✅ Authorized Uses:

• Security research and education
• Penetration testing skill development
• CTF competitions and training
• Academic coursework in cybersecurity
• Vulnerability assessment practice

❌ Prohibited Uses:

• Testing on systems without explicit authorization
• Production deployments of any kind
• Malicious attacks on real systems
• Distribution of exploitation tools for illegal purposes

Legal Compliance

• Always obtain written permission before testing systems you don't own
• Follow responsible disclosure practices for real vulnerabilities
• Comply with local laws and regulations regarding security testing
• Respect terms of service of all systems and platforms

Isolation Requirements

• ALWAYS run in Docker for proper isolation
• NEVER expose port 3000 to public internet
• Use only in controlled lab environments
• Stop/Destroy containers after research sessions

# Proper cleanup after use
docker-compose down -v --rmi all

🤝 Contributing

Contributions are welcome! Please follow these guidelines:

How to Contribute

1. Fork the repository
2. Create a feature branch (git checkout -b feature/AmazingFeature)
3. Commit your changes (git commit -m 'Add some AmazingFeature')
4. Push to the branch (git push origin feature/AmazingFeature)
5. Open a Pull Request

Contribution Ideas

• Add new exploitation challenge
• Improve documentation
• Create video tutorials
• Add new vulnerability demonstrations
• Enhance UI/UX
• Write automated exploitation scripts

Code of Conduct

• Be respectful and professional
• Focus on educational value
• Do not add malicious code
• Test thoroughly before submitting

📜 License

This project is licensed under the MIT License - see the LICENSE file for details.

Third-Party Assets

• Boxing bag icon from Flaticon (Free license with attribution)

🙏 Acknowledgments

• Next.js Team - For the framework (and patching the vulnerability)
• React Team - For React Server Components
• Security Researchers - Who discovered and disclosed CVE-2025-55182
• CTF Community - For inspiration and methodology
• OWASP - For security testing guidelines

Educational Resources

• OWASP Top 10
• PortSwigger Web Security Academy

📞 Contact & Support

• Issues: GitHub Issues
• Discussions: GitHub Discussions

🔄 Updates & Changelog

Version 1.0.0 (December 2025)

• Initial release
• 5 CTF challenges
• Docker support
• Complete documentation

⭐ Star History

If this project helped you learn about web security, please consider giving it a star! ⭐