CVE-2025-55182: React/Next.js Test

Project Status: Experimental / Proof of Concept

This repository serves as a controlled research environment and Proof-of-Concept (PoC) framework for analyzing CVE-2025-55182. It demonstrates a Prototype Pollution vulnerability within the context of Next.js Server Actions, specifically targeting insecure recursive merge operations.

Overview

The core vulnerability resides in a custom deepMerge utility function implemented within a Next.js Server Action (syncConfiguration). The function lacks adequate sanitization for special object keys—specifically __proto__ and constructor. This oversight allows an unauthenticated attacker to inject arbitrary properties into the global Object.prototype.

In a server-side Node.js runtime, successful prototype pollution can result in:

• Remote State Manipulation: Altering application logic, authorization flags (e.g., isAdmin), or configuration settings globally.
• Denial of Service (DoS): Destabilizing the application by overwriting critical internal methods such as toString or valueOf.
• Potential Remote Code Execution (RCE): While this lab primarily demonstrates state manipulation, prototype pollution can often be chained with other gadgets (e.g., in child_process or template engines) to achieve arbitrary code execution.

Repository Structure

• lab/next-app/: A vulnerable Next.js 15 application designed to simulate the security flaw.
  • src/app/actions.jsx: The server-side code containing the vulnerable deepMerge implementation.
• exploits/: Python automation scripts for testing and exploitation.
  • rce.py: A script that automates the injection of malicious JSON payloads to demonstrate server state pollution.
  • get-shell.py: An advanced PoC exploring RSC Flight Protocol deserialization vectors.
• docs/PAYLOADS.md: A reference document containing various JSON payloads for manual testing and analysis.

Usage Instructions

1. Environment Setup

You can run the lab using Docker (recommended) or locally.

Option A: Docker (Recommended)

Ensure Docker and Docker Compose are installed.

docker-compose up --build

The application will be accessible at http://localhost:3000.

Option B: Local Setup

Requires Node.js 20+.

cd lab/next-app
npm install
npm run dev

The application will be accessible at http://localhost:3000.

2. Manual Verification

1. Navigate to http://localhost:3000.
2. Select a payload from docs/PAYLOADS.md (e.g., the Basic Payload).
3. Input the payload into the "Config_Payload_Input" field and submit via "Commit_Changes".
4. Verify the "RUNTIME_POLLUTION_DETECTED" alert, indicating successful exploitation.

3. Automated Exploitation

The provided Python scripts allow for programmatic verification of the vulnerability.

Prerequisite: Retrieve the Next-Action ID from the browser's Network tab (look for a POST request header Next-Action) or the server terminal output.

Using Docker (Recommended)

1. Enter the attacker container:
   root@kitploit:~

   docker exec -it exploit-runner bash
   

2. Export the Action ID and run the exploit:
   root@kitploit:~

   export ACTION_ID="your_action_id_here"
   python3 rce.py "id"
   

Using Local Python

1. Install dependencies:
   root@kitploit:~

   pip install -r exploits/requirements.txt
   

2. Run the exploit (set ACTION_ID as env var or edit the script):
   root@kitploit:~

   export ACTION_ID="your_action_id_here"
   python3 exploits/rce.py "id"
   

Note: The rce.py script is configured to demonstrate successful state pollution. Full shell execution depends on specific environmental gadgets which may vary.

Disclaimer

This project is intended solely for educational purposes and security research.

Do not use the code or techniques provided here on systems for which you do not have explicit, written permission. The authors are not responsible for any misuse or damage caused by this material.