CVE-2025-55182 (React2Shell) Exploit Kit

🎯 Complete Working Exploit Demonstration

This project provides a fully functional demonstration of CVE-2025-55182 (React2Shell) - a critical Remote Code Execution vulnerability in React Server Components and Next.js.

Status: ✅ WORKING - Achieves actual command execution on vulnerable servers

🚀 What's Included

Working Exploit Binary

• Language: Go 1.25.5
• Binary: CVE-2025-55182 (7.8MB compiled executable)
• Capabilities:
  • Interactive RCE shell on vulnerable Next.js servers
  • Built-in file operations (cat, vi, touch, echo, rm)
  • Command execution with output parsing
  • File reading, writing, and editing

Vulnerable Test Server

• Next.js: 15.0.1 (deliberately vulnerable)
• React: 19.0.0 (deliberately vulnerable)
• Server Actions: Enabled
• Port: http://localhost:3001

🎥 Demo

📥 Download Demo Video (5.6MB) - Click to download and watch the exploit in action

What the demo shows:

• Starting the vulnerable Next.js server
• Running the CVE-2025-55182 exploit
• Interactive shell with command execution
• File operations (cat, vi, touch, rm)
• Reading sensitive files (package.json, .env)

✨ Quick Start

1. Start the Vulnerable Server

cd exploited-server
npm run dev
# Server starts on http://localhost:3001

2. Run the Exploit

cd /Users/subh/Desktop/code-playground/react-2-shell-demo
./CVE-2025-55182

# When prompted:
Target: localhost:3001

3. Execute Commands

Basic Commands:

subh@rce $ whoami
subh@rce $ pwd
subh@rce $ ls -la
subh@rce $ hostname

File Operations:

subh@rce $ touch hello.txt
[+] Created: hello.txt

subh@rce $ vi hello.txt
[i] Enter new content (type 'EOF' on a line by itself to finish):
Hello World!
EOF
[+] File saved: hello.txt

subh@rce $ cat hello.txt
Hello World!

subh@rce $ echo "New content" > hello.txt
[+] File written

subh@rce $ rm hello.txt
[+] Removed: hello.txt

System Info:

subh@rce $ cat package.json
subh@rce $ node --version
subh@rce $ npm --version
subh@rce $ ps aux

Exit:

subh@rce $ exit

📋 CVE-2025-55182 Details

• CVE ID: CVE-2025-55182
• Name: React2Shell
• CVSS Score: 10.0 (Critical)
• Type: Unauthenticated Remote Code Execution
• Attack Vector: Network
• Affected: React 19.0.0-19.2.0, Next.js 15.x-16.x with Server Actions

🎓 Educational Value

This project demonstrates:

✅ Real Exploitation - Actual working RCE on vulnerable systems
✅ Security Research - Understanding modern web framework vulnerabilities
✅ Go Development - Compiling and using security tools
✅ Vulnerability Analysis - CVE research and exploitation techniques
✅ Responsible Disclosure - Ethical security testing practices

🏗️ Project Structure

react-2-shell-demo/
├── CVE-2025-55182           # Compiled Go exploit binary
├── main.go                  # Go source code
├── exploited-server/        # Vulnerable Next.js app
│   ├── app/
│   │   ├── actions.ts       # Server Actions (vulnerable)
│   │   └── page.tsx         # Warning UI
│   └── package.json         # Next 15.0.1, React 19.0.0
└── *.md                     # Documentation

🎯 How It Works

The Vulnerability

CVE-2025-55182 exploits insecure deserialization in React Server Components:

1. Attack Vector: Malicious HTTP POST with crafted multipart payloads
2. Exploitation: Prototype pollution via __proto__
3. Trigger: Fake chunks that invoke Function() constructor
4. Result: Arbitrary code execution in Node.js context

The Exploit Flow

1. Craft multipart payload with malicious chunks
2. Send to Next.js Server Actions endpoint
3. Trigger prototype pollution via __proto__:then
4. Invoke Function() constructor with command
5. Execute code and return output via redirect
6. Parse result from X-Action-Redirect header

⚠️ Security Warning

CRITICAL NOTICES:

• ⛔ Vulnerable server is INTENTIONAL - Do not expose to internet
• ⛔ Use for authorized testing ONLY - Illegal without permission
• ⛔ Educational purposes - Security research and learning
• ⛔ Ethical use required - Follow responsible disclosure

📚 Documentation

• README.md - This file
• GO_EXPLOIT_USAGE.md - Detailed exploit usage
• VULNERABLE_SERVER.md - Server setup guide
• EXPLOITATION_GUIDE.md - Technical deep dive
• USAGE.md - Usage examples and commands

🔧 Requirements

• Go: 1.25+ (for compiling from source)
• Node.js: 18+ (for running vulnerable server)
• npm: Latest version
• OS: macOS, Linux, or Windows

🎯 Testing Workflow

1. ✅ Setup vulnerable server (npm run dev in exploited-server)
2. ✅ Run exploit binary (./CVE-2025-55182)
3. ✅ Enter target (localhost:3001)
4. ✅ Get interactive shell (subh@rce $)
5. ✅ Execute commands (whoami, ls, cat, etc.)
6. ✅ Exit when done (exit command)

🌟 Key Achievements

This project successfully demonstrates:

• ✅ Working RCE exploit against CVE-2025-55182
• ✅ Interactive command shell on vulnerable servers
• ✅ Complete exploitation workflow from setup to execution
• ✅ Educational security research with real-world tools
• ✅ Responsible vulnerability testing in controlled environment

🛡️ Mitigation

For Production Systems:

1. Update immediately to patched versions:

   • Next.js: 15.0.5+, 15.1.9+, 15.2.6+, 15.3.6+, 15.4.8+, 15.5.7+, 16.0.7+
   • React: 19.0.1+, 19.1.2+, 19.2.1+

2. Rotate secrets if exposed before December 4, 2025

3. Monitor logs for suspicious Server Actions activity

4. Audit applications using Server Components

📖 Learn More

• CVE-2025-55182 Official Record
• Next.js Security Advisory
• Wiz Research: React2Shell

👨‍💻 Author

@subhdotsol - For educational and security research purposes

📜 License

This code is for educational and authorized security testing only.

---

Remember: Always obtain proper authorization before testing. Use responsibly! 🔒