CVE-2025-55182 – React Server Components RCE Exploit

⚠️ Disclaimer: For authorized security testing and research purposes only. Do not use against systems without explicit permission.

Overview

This is an improved version of the exploit script for CVE-2025-55182 React Server Components Remote Code Execution vulnerability (Fixed Multipart Version).

Attribution & Contributors

This project is a modified version of the original proof-of-concept (PoC). We acknowledge the contributions of the following security researchers:

Key Improvements

Issues with Original Version

The original exploit script used requests.post(files=...) to construct multipart requests. While convenient, this approach introduced critical reliability issues:

• Automatic Boundary Generation: The requests library automatically generates a boundary and adds its own Content-Type header
• Content Transformation: May escape or transform payload content (e.g., quotes, newlines, JSON structures), breaking the delicate Flight protocol deserialization expected by the server
• Environment Compatibility: In strict parser, proxy, or WAF environments, this results in malformed requests or silent failures
• Detection Failures: The --check mode often falsely reported "not vulnerable" due to payload formatting discrepancies

Solution

This version ensures compatibility and reliability through the following approaches:

✅ Manual Multipart Construction: Built using raw bytes, preserving exact payload semantics

✅ RFC-Compliant Boundary: Auto-generated using uuid.uuid4() for valid boundary creation

✅ Correct Content-Type: Explicitly sets Content-Type header to match the raw body

✅ No Auto-Escaping: Preserves the integrity of _prefix and prototype pollution fields

✅ Consistent Application: Applies the same raw multipart logic in both methods:

• execute() method (for command execution)
• check_vulnerability() method (for accurate detection)

This ensures consistency between detection and exploitation, significantly improving success rates across diverse Next.js deployments.