🔍 Next.js RCE Scanner - CVE-2025-55182 & CVE-2025-66478

A powerful and easy-to-use scanner for detecting critical RCE vulnerabilities in Next.js applications

🎯 Overview

An advanced vulnerability scanner for detecting CVE-2025-55182 and CVE-2025-66478 - critical Remote Code Execution (RCE) vulnerabilities in Next.js applications using React Server Components (RSC).

This enhanced tool builds upon the excellent research by Assetnote Security Team with improved detection, ease of use, and comprehensive reporting.

🌟 Key Features

Triple-Layer Detection: Tests with RCE, Safe, and Vercel WAF bypass payloads
Auto-Detection: Automatically finds test_urls.txt in the same directory
Dual Mode: Scan single URL or bulk scan from file
Smart Redirect Handling: Follows redirects with same-host validation
Comprehensive Reports: Export results to JSON, CSV, or HTML
Retry Logic: Built-in resilience with automatic retries
Progress Tracking: Real-time progress bars for bulk scans
GUI & CLI: Optional graphical interface or command-line usage
Configurable: Customize payloads and detection patterns via config.json

🚨 Vulnerability Details

CVE-2025-55182 & CVE-2025-66478

These vulnerabilities affect Next.js applications using React Server Components through improper handling of multipart form-data requests:

Impact: Remote Code Execution (RCE)
Vector: Malicious multipart form-data payloads to RSC endpoints
Affected: Next.js applications with Server Actions enabled
Severity: Critical

Exploit Mechanism: The vulnerability exploits the RSC protocol's multipart parsing to inject arbitrary JavaScript code that executes server-side, allowing attackers to run system commands.

📦 Installation

Quick Setup (Recommended)

Windows:

setup.bat

Linux/macOS:

chmod +x setup.sh
./setup.sh

Manual Installation

Clone the repository:

git clone https://github.com/yourusername/nextjs-rce-scanner.git
cd nextjs-rce-scanner

Create virtual environment (optional but recommended):

python -m venv venv

# Windows
venv\Scripts\activate

# Linux/macOS
source venv/bin/activate

Install dependencies:

pip install -r requirements.txt

🚀 Usage

Quick Scan (Interactive Mode)

The simplest way to start scanning:

Windows:

scan.bat

Linux/macOS:

./scan.sh

Or directly:

python quick_scan.py

What happens:

Automatically detects test_urls.txt if present
Prompts for single URL or loads file
Runs triple-layer detection (RCE + Safe + Vercel bypass)
Displays results with detailed vulnerability information

Single URL Scan

python quick_scan.py
# When prompted, enter: 1
# Enter URL: https://target.com

Bulk Scan from File

Create test_urls.txt in the same directory:

https://example1.com
https://example2.com
https://example3.com

Run scanner:

python quick_scan.py
# Auto-detects test_urls.txt and scans all URLs

Advanced Usage (Full Engine)

python nextjs_rce_scanner.py --url https://target.com --payload-type rce

Options:

--url: Single target URL
--file: Path to file with URLs (one per line)
--payload-type: Payload variant (rce, safe, waf_bypass, vercel_bypass, custom)
--output: Report file path
--format: Report format (json, csv, html)
--gui: Launch graphical interface
--timeout: Request timeout in seconds
--max-redirects: Maximum redirects to follow
--verbose: Detailed output

Example:

python nextjs_rce_scanner.py --file targets.txt --format html --output scan_results.html --verbose

📊 Output Examples

Console Output

═══════════════════════════════════════════════════════════
🔍 Next.js RCE Scanner - Triple Layer Detection
═══════════════════════════════════════════════════════════

[*] Auto-detected file: test_urls.txt
[*] Loading URLs from file...
[*] Loaded 5 URLs

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[1/5] Scanning: https://example.com
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

  [✓] RCE Payload Test       → Secure
  [✓] Safe Payload Test      → Secure
  [✓] Vercel Bypass Test     → Secure

  Status: ✅ SECURE (0/3 payloads detected vulnerability)
  Response: 405 (Method Not Allowed)

Report Files

JSON Report:

{
  "scan_timestamp": "2025-01-15T10:30:00",
  "total_targets": 5,
  "vulnerable": 0,
  "results": [...]
}

HTML Report: Professional formatted report with color-coded results, scan statistics, and detailed findings.

🔧 Configuration

Customize scanner behavior via config.json:

{
  "scanner_settings": {
    "timeout": 30,
    "max_redirects": 5,
    "verify_ssl": false
  },
  "payloads": {
    "rce_commands": {
      "unix_test": "echo $((41*271))",
      "windows_test": "powershell -c \"41*271\""
    }
  },
  "detection": {
    "rce_patterns": [".*/login\\?a=11111.*"],
    "safe_error_codes": [500]
  },
  "rate_limiting": {
    "enabled": true,
    "requests_per_second": 2
  }
}

🛡️ Detection Methods

Layer 1: RCE Payload

Injects command execution payload via multipart form-data
Detects X-Action-Redirect header with specific pattern
Confirms code execution capability

Layer 2: Safe Payload

Uses non-destructive test payload
Checks for 500 status code and error messages
Identifies vulnerability without exploitation

Layer 3: Vercel WAF Bypass

Alternative multipart structure to evade WAF
Tests different content-type boundaries
Comprehensive coverage for protected targets

📂 Project Structure

nextjs-rce-scanner/
├── nextjs_rce_scanner.py   # Main scanner engine (full features)
├── quick_scan.py            # Simple interactive wrapper
├── config.json              # Configuration file
├── requirements.txt         # Python dependencies
├── test_urls.txt            # URL list for bulk scanning
├── setup.sh                 # Linux/Mac installation script
├── setup.bat                # Windows installation script
├── scan.sh                  # Linux/Mac quick launcher
├── scan.bat                 # Windows quick launcher
├── README.md                # This file
└── LICENSE                  # MIT License

🧪 Testing

Test against known vulnerable environments (ethical testing only):

python quick_scan.py

Enter test URL when prompted. The scanner will:

Test RCE payload
Test Safe payload
Test Vercel bypass variant
Provide detailed analysis

⚠️ Legal Disclaimer

FOR EDUCATIONAL AND AUTHORIZED TESTING ONLY

This tool is provided for security research, vulnerability assessment, and authorized penetration testing. Users must:

✅ Obtain explicit written permission before scanning any target
✅ Comply with all applicable laws and regulations
✅ Use responsibly and ethically
❌ NOT use for unauthorized access or malicious purposes
❌ NOT scan systems you don't own or have permission to test

Next.js-RCE-Scanner---CVE-2025-55182-CVE-2025-66478

Most Popular