namsom007/cve-2025-55182-exploitCVE-2025-55182 React Server Components Remote Code Execution Exploit Lab
An intentional vulnerable Next.js application demonstrating Remote Code Execution (RCE) via insecure Child Process handling. This lab is designed for educational purposes and security testing.
⚠️ WARNING: DOT NOT RUN THIS ON A PUBLIC FACING SERVER. IT CONTAINS A REMOTE CODE EXECUTION VULNERABILITY.
The application is a simple "Server Status Monitor". The backend takes a user-supplied hostname and executes a ping command. However, the input is not sanitized, allowing an attacker to inject arbitrary OS commands.
docker-compose up -d --build
The application will be available at http://localhost:3000.
8.8.8.8) to see the ping output.; or | or &.
8.8.8.8; idgoogle.com | ls -lalocalhost & cat /etc/passwdLocated in pages/api/status.js:
const { host } = req.query;
// ...
exec(`ping -c 1 ${host}`, (error, stdout, stderr) => { ... });