CVE-2025-55182 Toolkit & Lab (Educational Only)

Lightweight Go toolkit plus a Dockerized Next.js lab to explore and triage CVE-2025-55182. For educational and authorized testing only.

Features

• Root-cause writeup, visuals, and lab: see React2Shell_Deconstructing_a_Perfect_10_RCE.pdf and the attack-path diagram

• Single binary with subcommands:
  • checker: fast, concurrent inventory scan (single target, file, or stdin), heuristic for RSC exposure, JSON output per target, final summary, optional -only-vuln, -no-progress, custom -ua.
  • poc: sends the exploit-style RSC multipart request and prints the returned digest; supports custom command via -c (default id).
• Concurrency control (-c), timeouts, and progress stats.
• Tolerant target input: -target, -list, or -stdin; auto-prepends https:// when missing scheme.
• Lab environment (vulnlab/) with Next.js 15.5.6/React 19, Dockerfile and docker-compose.yml pinned to localhost:3000 for safe repro.

Build

cd checker
GOCACHE=/tmp/go-cache go build -o CVE-2025-55182 ./cmd/CVE-2025-55182

Set GOCACHE if your environment has cache permission issues.

Usage

# Scanner
./CVE-2025-55182 checker -target https://example.com
./CVE-2025-55182 checker -list ../targets.txt -c 50 -only-vuln
cat ../targets.txt | ./CVE-2025-55182 checker -stdin -no-progress

# PoC (exploit-style request)
./CVE-2025-55182 poc -target http://localhost:3000
./CVE-2025-55182 poc -target http://localhost:3000 -c "whoami"

Root Cause (why this is exploitable)

CVE-2025-55182 is an unsafe deserialization bug in how React Server Components load modules from Flight payloads. In react-server-dom-webpack, the helper requireModule(metadata) pulls a module and then returns moduleExports[metadata[2]]. Bracket access walks the prototype chain, so an attacker-controlled reference like $1:constructor:constructor climbs from an exported function to its constructor (the global Function constructor) and can execute arbitrary JS. The Flight protocol lets attackers supply those colon-separated property paths, turning the module loader into a gadget for remote code execution.

Lab (vulnlab/)

cd vulnlab
docker compose build
docker compose up
# App listens on 127.0.0.1:3000 inside the container; runs as non-root user.

• Dockerfile builds a Next.js app (Node 20 Alpine), installs deps, builds, and runs as a non-root nextjs user.
• docker-compose.yml binds 127.0.0.1:3000:3000 for local-only testing by default.

Detection Rules

Snort / Suricata (HTTP to server)

alert http any any -> $LAN_NETWORK any (
    msg:"Potential Next.js React2Shell / CVE-2025-66478 attempt";
    flow:to_server,established;
    content:"Next-Action"; http_header; nocase;
    content:"multipart/form-data"; http_header; nocase;
    pcre:"/Content-Disposition:\s*form-data;\s*name=\"0\"/s";
    pcre:"/\"status\"\s*:\s*\"resolved_model\"/s";
    pcre:"/\"then\"\s*:\s*\"\$1:__proto__:then\"/s";
    classtype:web-application-attack;
    sid:6655001;
    rev:1;
)

Query (vulnerable React RSC packages)

{
  "queries": {
    "detect_rev2shell_react_server_components": {
      "query": "SELECT name, version, path FROM npm_packages WHERE (name='react-server-dom-parcel' AND (version='19.0.0' OR (version >= '19.1.0' AND version < '19.1.2') OR version='19.2.0')) OR (name='react-server-dom-turbopack' AND (version='19.0.0' OR (version >= '19.1.0' AND version < '19.1.2') OR version='19.2.0')) OR (name='react-server-dom-webpack' AND (version='19.0.0' OR (version >= '19.1.0' AND version < '19.1.2') OR version='19.2.0'));",
      "interval": 3600,
      "description": "Detects vulnerable versions of React Server Components packages (react-server-dom-*) affected by CVE-2025-55182 / CVE-2025-66478 / React2Shell.",
      "platform": "linux,windows,macos",
      "version": "1.0"
    }
  }
}

Safety & Ethics

• Provided strictly for educational, defensive, and authorized testing.
• Do not target systems you do not own or have explicit permission to test.