security-phoenix-demo/react2shell-scanner-rce-react-next-cve-2025-55182-cve-2025-66478
Scanner for CVE-2025-55182 (React) and CVE-2025-66478 (Next.js) - Track and remediate a critical React Server Components (RSC) / Flight protocol vulnerability campaign impacting react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack, and RSC-enabled frameworks like Next.js.
EXTERNAL Vulnerability for React2Shell class of bugs: two freshly disclosed, unauthenticated remote code execution vulnerabilities in the React Server Components (RSC) "Flight" protocol—CVE-2025-55182 (React) and CVE-2025-66478 (Next.js), both rated CVSS 10.0. These issues live in how RSC/Server Function endpoints decode attacker-controlled Flight payloads, turning a single crafted HTTP request into potential server-side code execution—even on "default" modern React/Next.js stacks using App Router and production builds. For many teams this is a "patch now, verify exposure, then audit" moment, not something to defer to a later dependency hygiene sprint. The LAB folder contains exploits and lab vulnerabilities for React2Shell
This project provides a two-pronged approach: (1) software composition / dependency risk scanning (this tool), to rapidly locate vulnerable libraries and versions, and (2) a web DAST scanner (React2Shell Web Scanner) that actively probes RSC/Flight endpoints from the outside, validating whether exploitable paths are reachable in running environments. Together, they help you answer both "where are the vulnerable components?" and "where can they actually be exploited in production?" so you can prioritize patching, hardening, and incident response with confidence.
For live endpoint testing and RCE validation, see the dedicated web scanner:
📁 web-scan_CVE-2025-66478/ - Full documentation and guide
cd web-scan_CVE-2025-66478
# Install dependencies
pip install -r requirements.txt
# Scan a single target
python3 react2shell-scanner -u https://target.com -v
# Scan with evidence display
python3 react2shell-scanner -u https://target.com --show-evidence
# Batch scan with all export formats
python3 react2shell-scanner -l targets.txt -o results.json --csv results.csv --html report.html
# Test the exploit on vulnerable target (requires Python 3.11+)
python3.11 test-lab/exploit.py -u http://vulnerable-host:3000 -c "hostname"
| Feature | Description |
|---|---|
| 🔍 RCE Detection | Arithmetic-based safe detection (no side effects) |
| 🎯 Technology Fingerprinting | Auto-detect Next.js/React applications |
| 📊 Multi-Format Export | JSON, CSV, HTML reports |
| 🔗 IOC Correlation | Match against 31+ known malicious IPs |
| 🌐 Scale Scanning | CIDR ranges, subdomain enumeration |
| ☁️ Phoenix Integration | Upload findings to Phoenix Security |
| 💻 Exploit Tool | Execute commands on vulnerable targets |
cd web-scan_CVE-2025-66478/test-lab/lab
# Start vulnerable (3011) and patched (3012) instances
docker-compose up -d
# Test vulnerable instance
python3 react2shell-scanner -u http://localhost:3011 --show-evidence
cd web-scan_CVE-2025-66478/test-lab
# Install exploit dependencies
pip3.11 install -r requirements.txt
# Basic command execution
python3.11 exploit.py -u http://localhost:3011 -c "whoami"
# Output: nextjs
python3.11 exploit.py -u http://localhost:3011 -c "id"
# Output: uid=1001(nextjs) gid=65533(nogroup)
python3.11 exploit.py -u http://localhost:3011 -c "hostname"
# Output: 99e28775bf80 (container ID)
# System enumeration
python3.11 exploit.py -u http://localhost:3011 -c "uname -a"
python3.11 exploit.py -u http://localhost:3011 -c "cat /etc/passwd"
python3.11 exploit.py -u http://localhost:3011 -c "env"
# Application recon
python3.11 exploit.py -u http://localhost:3011 -c "pwd" # /app
python3.11 exploit.py -u http://localhost:3011 -c "ls -la"
python3.11 exploit.py -u http://localhost:3011 -c "cat package.json"
python3.11 exploit.py -u http://localhost:3011 -c "node --version"
React2Shell is an unauthenticated remote code execution primitive against React Server Components (RSC) payload handling in the Flight protocol. In practice, this means a malicious client can send a single crafted HTTP request to an RSC/Server Function endpoint and, if a vulnerable version is in play, potentially turn a “web app” into a “server shell.”
At a high level:
Because this is unauthenticated RCE, default production setups are in scope—even if you never explicitly wrote a “server function” and simply adopted modern React/Next.js patterns. Hosting-level mitigations and generic WAFs should not be treated as your primary safety net: they may reduce exposure but won’t reliably compensate for vulnerable libraries. Treat this as an incident:
Once an attacker lands RCE via React2Shell, defenders should assume a familiar kill chain:
.env files, deployment secrets, CI tokens, service credentials, and signing keys.If your DevSecOps pipeline has historically treated the web tier as “just a frontend,” this vulnerability is a concrete demonstration that frontend frameworks can carry deep server-side blast radius when RSC and streaming semantics are involved. Universal Vulnerability Scanner exists to help you rapidly answer “are we running the vulnerable packages anywhere?” and to feed that answer into Phoenix-driven campaigns and, soon, complementary web DAST validation of live RSC endpoints.
# Install dependencies
pip install -r requirements.txt
# Run from project root
python -m universal_vulnerability_scanner.main --help
# Basic scan
python -m universal_vulnerability_scanner.main scan /path/to/project
# With JSON output
python -m universal_vulnerability_scanner.main scan /path/to/project --json --output results.json
# Quiet mode (only show summary)
python -m universal_vulnerability_scanner.main scan /path/to/project --quiet
# Create Phoenix configuration template
python -m universal_vulnerability_scanner.main create-config
# Edit .phoenix.config with your credentials
# Then scan and upload
python -m universal_vulnerability_scanner.main scan /path/to/project --upload-phoenix
# Test with included vulnerable samples
python -m universal_vulnerability_scanner.main test
The scanner uses a JSON-based vulnerability database located at:
universal_vulnerability_scanner/data/vulnerability_database.json
{
"metadata": {
"version": "1.0.0",
"last_update": "2025-12-04",
"ecosystems": ["npm"]
},
"vulnerabilities": {
"npm": {
"package-name": {
"exact_versions": ["1.0.0", "1.0.1"],
"vulnerable_ranges": [
{"min": "1.0.0", "max": "1.0.2", "severity": "CRITICAL"}
],
"safe_versions": ["1.0.2+"],
"cve_ids": ["CVE-2025-XXXX"],
"description": "Vulnerability description",
"references": ["https://..."]
}
}
}
}
Create .phoenix.config:
[phoenix]
client_id = your_client_id_here
client_secret = your_client_secret_here
api_base_url = https://api.securityphoenix.cloud
assessment_name = Universal Vulnerability Scanner - RSC Detection
import_type = new
Or use environment variables:
export PHOENIX_CLIENT_ID="your_client_id"
export PHOENIX_CLIENT_SECRET="your_client_secret"
export PHOENIX_API_URL="https://api.securityphoenix.cloud"
================================================================================
UNIVERSAL VULNERABILITY SCANNER REPORT
================================================================================
Scan completed: 2025-12-04 10:30:00
SUMMARY:
----------------------------------------
Total findings: 12
VULNERABLE: 3
SAFE: 2
CLEAN: 5
REVIEW: 2
🚨 VULNERABLE PACKAGES DETECTED
================================================================================
1. [email protected]
File: /path/to/project/package.json
Reason: Exact match with known vulnerable version 19.0.0
✅ Safe version: 18.99.99
CVE: CVE-2025-RSC-001
[
{
"path": "/path/to/project/package.json",
"kind": "package.json",
"package": "react-server-dom-webpack",
"version": "19.0.0",
"verdict": "VULNERABLE",
"reason": "Exact match with known vulnerable version 19.0.0",
"severity": "CRITICAL",
"vulnerable_versions": ["19.0.0", "19.1.0", "19.1.1", "19.2.0"],
"safe_version": "18.99.99",
"cve_ids": ["CVE-2025-RSC-001"],
"timestamp": "2025-12-04T10:30:00"
}
]
The scanner includes comprehensive test samples in test_samples/:
| Test Case | Description | Expected Results |
|---|---|---|
rsc_vulnerable_exact/ | Exact vulnerable versions | 4 VULNERABLE |
rsc_vulnerable_range/ | Version ranges | 4 VULNERABLE |
rsc_safe_versions/ | Patched safe versions | 6 SAFE |
rsc_mixed/ | Mix of vulnerable/safe/clean | 2 VULNERABLE, 1 SAFE, 4 CLEAN |
rsc_with_lockfile/ | Lockfile parsing | 2 VULNERABLE, 1 CLEAN |
Run tests:
python -m universal_vulnerability_scanner.main test
universal_vulnerability_scanner/
├── core/
│ └── version_parser.py # Semver parsing & comparison
├── models/
│ ├── finding.py # Finding data model
│ └── vulnerability.py # Vulnerability database model
├── scanners/
│ ├── base_scanner.py # Abstract scanner interface
│ └── npm_scanner.py # NPM ecosystem scanner
├── integrations/
│ └── phoenix_uploader.py # Phoenix API client
├── data/
│ └── vulnerability_database.json # Vulnerability definitions
├── test_samples/ # Test cases
└── main.py # CLI entry point
scanners/ inheriting from BaseScannerExample:
from .base_scanner import BaseScanner
class PyPIScanner(BaseScanner):
def _get_ecosystem(self) -> str:
return "pypi"
def scan_path(self, root: Path) -> List[Finding]:
# Implement PyPI scanning logic
pass
Edit data/vulnerability_database.json:
{
"npm": {
"new-vulnerable-package": {
"exact_versions": ["1.0.0"],
"vulnerable_ranges": [{"min": "1.0.0", "max": "1.0.5", "severity": "HIGH"}],
"safe_versions": ["1.0.5+"],
"cve_ids": ["CVE-2025-XXXX"],
"description": "Vulnerability description"
}
}
}
0 - Scan successful, no vulnerabilities found1 - Scan successful, vulnerabilities found2 - Scan failed (invalid input, database error, etc.)Automatically uploads findings to Phoenix with:
# Example GitHub Actions
- name: Vulnerability Scan
run: |
python -m universal_vulnerability_scanner.main scan . --json --output scan-results.json
- name: Upload to Phoenix
if: always()
run: |
python -m universal_vulnerability_scanner.main scan . --upload-phoenix
react/rsc_exposure_scanner.pyenhanced_npm_compromise_detector_phoenix.pyPart of the Shai Halud security toolkit.
🔍 Stay secure! Report vulnerabilities responsibly.