CHECK-CVE-2025-55182-AND-CVE-2025-66478

This script detects if a server is affected by RSC/Next.js RCE vulnerabilities CVE-2025-55182 and CVE-2025-66478.

It checks the server response for specific vulnerability signatures.

Those signatures should be specific according to Searchlight Cyber

So the implementation of this shell script follows Searchlight Cyber's insights.

I have more information about these CVEs currently only in German, but officially from the German Federal Office for Information Security:

React Server Components: Kritische Schwachstelle bedroht zahlreiche Webanwendungen

Usage:

bash ./rce-test.sh <your-domain.com>

If the result is green, it means the server on the given domain is not vulnerable. Red means that the signatures were found, so probably vulnerable.