Next.js RCE Assessment Toolkit

A Python toolkit for validating and investigating CVE-2025-55182, also known as React2Shell, in authorized environments. The vulnerability affects React Server Components and can expose applications built with frameworks such as Next.js to unauthenticated remote code execution. The toolkit combines target collection, bulk validation, an interactive test shell, host enumeration, and optional post-validation utilities.

Vulnerability

CVE: CVE-2025-55182
Name: React2Shell
Class: Unauthenticated remote code execution
Affected technology: React Server Components and dependent frameworks, including affected Next.js configurations
Toolkit validation: hosts_scanner.py executes only a fixed echo VULN_TEST marker during bulk detection

This repository is an assessment aid, not a substitute for checking the official advisory and applying vendor patches.

Capabilities

Tool	Purpose	Output or effect
`shodan_parser.py`	Opens authenticated Shodan searches from a query list and collects normalized HTTP(S) origins.	Appends unique hosts to `files/targets.txt`.
`hosts_scanner.py`	Concurrently checks a target list with a fixed `VULN_TEST` command.	Writes confirmed targets to `files/vulnerable.txt` and unsuccessful targets to `files/trash.txt`.
`exploit.py`	Re-validates one target and provides an interactive command session.	Prints remote command output in the terminal.
`universal_scanner.py`	Collects system, container, network, filesystem, process, credential-exposure, and privilege-risk information.	Saves detailed findings to `scan_results.json`.
`infrastructure/universal_download.py`	Transfers a remote file through the command channel in resumable Base64 chunks.	Creates or resumes a local file and verifies its size.
`infrastructure/mongo_proxy.py`	Uses the validated host as a network path for MongoDB inventory and limited sampling.	Lists databases, collections, counts, and a small sample.
`infrastructure/mongo_dump.py`	Exports one MongoDB database or all non-system databases with a per-collection limit.	Creates a JSON file under `/tmp` on the assessed host.
`infrastructure/aws_dump.py`	Inventories AWS resources available to an ECS task role.	Creates a JSON file under `/tmp`; may include sensitive values.
`infrastructure/install_ssh_key.py`	Adds a public key to the current remote user's `authorized_keys`.	Modifies remote SSH configuration and establishes persistence.
`infrastructure/trace_cleaner.py`	Removes toolkit artifacts and attempts to clear histories, caches, and logs.	Destructively modifies remote files; use only during an approved cleanup exercise.

The RCE-dependent tools expect a Linux-like target with common shell utilities. Some infrastructure helpers additionally expect Node.js and the relevant npm packages to already be available on the assessed host.

Requirements

Python 3.10 or newer
Network access to the authorized target
Chromium installed through Playwright for shodan_parser.py
A Shodan account for target collection

Installation

python -m venv .venv

Activate the environment:

# Linux or macOS
source .venv/bin/activate

# Windows PowerShell
.\.venv\Scripts\Activate.ps1

Install dependencies:

python -m pip install -r requirements.txt
python -m playwright install chromium

For Shodan collection, copy .env.example to .env and set LOGIN and PASSWORD. Never commit .env.

Typical Workflow

Put one Shodan query per line in files/queries.txt, or place authorized targets directly in files/targets.txt.
Optionally collect targets with python shodan_parser.py.
Run the fixed-marker bulk check:

python hosts_scanner.py --file files/targets.txt --concurrency 50 --timeout 30

Review files/vulnerable.txt and manually verify ownership and scope before running any command-execution or infrastructure utility.

To reset the scanner skip list:

python hosts_scanner.py --file files/targets.txt --clear-trash

Single-Target Tools

python exploit.py https://target.example
python universal_scanner.py https://target.example

Infrastructure utilities:

python infrastructure/universal_download.py <TARGET> <REMOTE_PATH> [LOCAL_FILE] [CHUNK_SIZE]
python infrastructure/mongo_proxy.py <TARGET> <MONGODB_URI>
python infrastructure/mongo_dump.py <TARGET> <MONGODB_URI> <DATABASE|ALL> [OUTPUT_FILE] [LIMIT]
python infrastructure/aws_dump.py <TARGET> [OUTPUT_FILE]
python infrastructure/install_ssh_key.py <TARGET> [PUBLIC_KEY_PATH]
python infrastructure/trace_cleaner.py <TARGET>

Run each script without arguments to see its complete command-line help.

Limitations

TLS certificate verification is disabled in the current HTTP client calls.
Detection depends on response formats used by the affected Next.js behavior.
Remote commands assume tools such as bash, base64, dd, and timeout.
Cloud and database results are limited by the remote identity's permissions.
The toolkit does not provide remediation or prove that a target is in scope.

Most Popular

react2shell-toolkit