CVE-2025-55182 (React2Shell)

CVE-2025-55182 React RCE Test Program

🔒 CVE-2025-55182 Interactive RCE Scanner

This script is a vulnerability verification tool targeting CVE-2025-55182, a critical remote code execution (RCE) vulnerability in React 19.x's React Server Components (RSC) .

This tool determines whether the vulnerability exists on a real server and, depending on options, can execute commands, log outputs, or test using the two-stage RCE method (module#_load) .

⚠️ This tool must only be used in closed test environments for security auditing and vulnerability verification purposes .

📋 React2Shell (CVE-2025-55182) Vulnerability Summary

🧱 Affected Products and Versions

✅ Projects that include RSC functionality must also upgrade the react-server-dom-* modules to the latest version separately from React to be safe.

📚 Table of Contents

• 🗂️ 디렉토리 구조
• 🧩 주요 기능
• 📦 설치 방법
• 🚀 실행 예시
• 💬 인터랙티브 명령어 입력 예시
• ⚠️ 보안 주의사항
• 📚 기술 참고
• 📄 라이선스 및 사용 조건

🗂️ Directory Structure

CVE-2025-55182/
├── README.md                     # Full overview and scanner usage
├── DETECTION_RULES.md            # Detection/blocking rules collection
├── 설명 및 탐지규칙.md             # Korean detection rules explanation
├── cve_2025_55182_interactive.py # RCE verification scanner script
├── requirements.txt              # Scanner dependency list
├── setup_vulnerable_env.sh       # One-click vulnerable environment setup script
├── uninstall_vulnerable_env.sh   # Vulnerable environment cleanup/removal script
└── vulnerable-react-env/         # React2Shell vulnerable server practice code
    ├── README.md                 # Practice environment usage
    ├── package.json              # npm scripts and dependencies
    ├── server.js                 # Vulnerable Express backend
    ├── public/
    │   └── index.html            # CDN-based React frontend
    └── .gitignore

🧩 Key Features

✅ Interactively test whether RCE is possible on a vulnerable server
✅ Supports child_process#execSync (default) or module#_load method
✅ Save command execution results to a log file
✅ Send user-entered system commands to the server

📦 Installation

git clone <this-repo>
cd <this-repo>
pip install -r requirements.txt

🚀 Execution Examples

1. Basic RCE test (execSync method)

   • Command execution using child_process.execSync()
   • python cve_2025_55182_interactive.py http://localhost:3000 --rce

2. Two-stage RCE test (module#_load method)

   • Create a malicious JS file and execute it via module#_load
   • python cve_2025_55182_interactive.py http://localhost:3000 --rce --method moduleLoad

3. RSC-based RCE test (--rce2 option)

   • Execute payload via Next.js server component processing path
   • python cve_2025_55182_interactive.py http://localhost:3000 --rce2

4. Save command execution results to log

   • Save all command results to a specified log file
   • python cve_2025_55182_interactive.py http://localhost:3000 --rce --log rce_output.log

5. Full feature usage (method + log)

🚧 Vulnerable React Server Practice Environment (OCI/Ubuntu)

The vulnerable-react-env folder contains an intentionally vulnerable React + Express server that can reproduce CVE-2025-55182.

1. Quick batch setup (recommended)
   
   • Running ./setup_vulnerable_env.sh will complete apt package installation → nvm/Node.js 20 installation → npm install in one go.
     
   • After completion, run the server with cd vulnerable-react-env && npm start or npm run dev.
     
   • ⚠️ Entering only npm run will just list the scripts. Be sure to specify the script name like npm start (or npm run start).
     
   • To clean up the environment, use ./uninstall_vulnerable_env.sh to remove node_modules, moduleLoad payload, and (optionally) Node 20 and nvm.
     
   • ❗️ If dependency errors like ERR_MODULE_NOT_FOUND: Cannot find package 'express' occur, run cd vulnerable-react-env && npm install to install node_modules, then run npm start again.
     
2. Manual setup (alternative)
   
   • sudo apt update && sudo apt install -y curl build-essential

⚠️ For research/educational purposes only. Do not expose to the internet.

💬 Interactive Command Input Examples

💬 Enter system command: whoami
✅ Response code: 200
📄 Response content: {"success":true,"result":"www-data"}

💬 Enter system command: id
✅ Response code: 200
📄 Response content: {"success":true,"result":"uid=1000(hacker) gid=1000(hacker)"}

💬 Enter system command: exit
👋 Exiting.

⚠️ Security Precautions

❌ Never use in production environments.
✅ This script must only be used in a local test environment or an isolated VM.
🛠️ The --method moduleLoad method creates an actual file at /tmp/evil.js.
🧾 When using the --log option, output results are stored in plaintext, so restrict file access.
🔐 All requests verify that actual JavaScript code is executed on the vulnerable server.

📚 Technical Reference

• Official CVE: CVE-2025-55182

• Exploit methods:

  1. child_process#execSync
  2. vm#runInThisContext
  3. fs#writeFileSync
  4. module#_load

• Attack flow:

  1. Send a specially crafted multipart/form-data to the /formaction endpoint
  2. Server calls requireModule()
  3. RCE occurs via prototype chain or bound function execution

📄 License and Terms of Use

This project is provided solely for security research, auditing, and testing purposes.
Unauthorized use against real systems is illegal.

All legal responsibility arising from the use of this tool lies with the user.