Next.js RSC RCE Exploit Tool (CVE-2025-55182)

Project Introduction

CVE-2025-55182 is a high-severity vulnerability in Next.js's Server Component (RSC) processing chain. An attacker can craft special multipart/form-data requests and forged RSC response chunks to induce the server to execute arbitrary JavaScript code, ultimately achieving remote command execution through process.mainModule.require('child_process').

This project packages the exploit chain into a graphical desktop tool, reducing the verification cost for security researchers in authorized testing environments. It integrates:

• Arithmetic probe auto-detection
• Synchronous/asynchronous command execution (with/without output)
• Arbitrary JS code execution
• Remote file read, write, and directory listing
• Dynamic Node module loading
• Unicode / UTF-16 / AES multi-layer payload obfuscation to bypass common WAF detection
• HTTP / HTTPS / SOCKS5 proxy support

Quick Start

1. Clone the Repository

git clone <repo-url> Nextjs_Exploit_Tool
cd Nextjs_Exploit_Tool

2. Build the Production Package

wails build

The build artifacts are located in build/bin/:

• macOS: NextjsExploitTool.app
• Windows: NextjsExploitTool.exe
• Linux: NextjsExploitTool

3. Cross-compilation

# Windows (cross-compiled from macOS/Linux)
GOOS=windows wails build

# Linux (cross-compiled from macOS, requires mingw-w64)
GOOS=linux wails build

Before cross-compiling, the C toolchain for the corresponding platform must be configured. See the Wails documentation.

Homepage Preview

Reference Project

https://github.com/pyroxenites/Nextjs_RCE_Exploit_Tool

Disclaimer

This project is intended solely for authorized security testing, security research, and teaching demonstrations. Users must comply with local laws and regulations and ensure they have obtained explicit written authorization from the target system owner.

• Must not be used against any unauthorized real-world targets
• Must not be used to disrupt, intrude upon, or affect the availability of others' systems
• The author assumes no responsibility for any consequences resulting from the misuse of this tool

By using this tool, you acknowledge that you have read and agree to the above terms. If you are unsure whether your actions are legal, do not use it.

License

This project is for research and authorized testing purposes only.