React2Shell (CVE-2025-55182) - Proof of Concept

A comprehensive proof-of-concept exploit and educational resource for CVE-2025-55182, a critical remote code execution vulnerability affecting React Server Components with a CVSS score of 10.0.

Legal Disclaimer

FOR EDUCATIONAL AND AUTHORIZED TESTING PURPOSES ONLY

This tool is provided for educational purposes and authorized security testing only. Unauthorized access to computer systems is illegal under various laws including the Computer Fraud and Abuse Act (CFAA) in the United States and similar legislation worldwide.

You must:

• Only use this tool on systems you own or have explicit written authorization to test
• Comply with all applicable local, state, and federal laws
• Use this tool responsibly and ethically

The author and contributors:

• Are not responsible for any misuse or damage caused by this tool
• Do not endorse or encourage unauthorized access to computer systems
• Provide this tool strictly for educational and defensive security purposes

By using this tool, you acknowledge that you understand and agree to these terms.

📋 Table of Contents

• Overview
• Vulnerability Details
• Affected Versions
• Technical Analysis
• Installation
• Usage
• Detection
• Remediation
• Lab Environment Setup
• References
• Contributing
• Author

🎯 Overview

React2Shell is a critical vulnerability discovered in December 2025 that affects React Server Components (RSC) and frameworks implementing them, particularly Next.js. The vulnerability allows unauthenticated remote code execution through a single crafted HTTP request.

This repository contains:

• ✅ Automated Python exploit script
• ✅ Detailed technical analysis
• ✅ Detection rules (Snort, OSQuery)
• ✅ Lab environment setup guide
• ✅ Comprehensive documentation

🔍 Vulnerability Details

What Makes This Critical?

1. No Authentication Required - Exploitable by any unauthenticated attacker
2. Default Configurations Vulnerable - Standard Next.js apps created with create-next-app are exploitable
3. High Reliability - Near 100% exploitation success rate
4. Wide Attack Surface - 571,000+ public servers running React components (Shodan data)
5. Severe Impact - Full remote code execution with Node.js process privileges

📦 Affected Versions

React Server Components

Vulnerable versions:

• react-server-dom-webpack: 19.0.0, 19.1.0, 19.1.1, 19.2.0
• react-server-dom-parcel: 19.0.0, 19.1.0, 19.1.1, 19.2.0
• react-server-dom-turbopack: 19.0.0, 19.1.0, 19.1.1, 19.2.0

Patched versions:

• React 19.0.1
• React 19.1.2
• React 19.2.1

Next.js

Vulnerable versions:

• All versions ≥14.3.0-canary.77
• All 15.x releases (pre-patch)
• All 16.x releases (pre-patch)

Patched versions:

• Check Next.js releases for updated versions incorporating React patches

Other Affected Frameworks

• React Router (when using RSC mode)
• Waku
• Redwood SDK
• Various RSC-enabled frameworks

🔬 Technical Analysis

Root Cause

The vulnerability exists in the requireModule function within React Server Components' deserialization logic:

function requireModule(metadata) {  
  var moduleExports = __webpack_require__(metadata[0]);  
  return moduleExports[metadata[2]];  // VULNERABLE LINE - Prototype chain traversal
}

The flaw allows attackers to traverse JavaScript's prototype chain through the React Flight protocol, accessing the Function constructor via properties like constructor.constructor, enabling arbitrary code execution.

Exploitation Chain

1. Fake Chunk Creation - Attacker sends multipart form data with a crafted chunk object
2. Prototype Pollution - Exploits __proto__ to create self-referential structure
3. Blob Handler Abuse - Triggers React's internal Blob deserialization handler
4. Function Constructor Access - Chains through constructor.constructor to access Function()
5. Code Execution - Injects arbitrary JavaScript via child_process.execSync()

Attack Flow Diagram

┌─────────────────────────────────────────────────────────────┐
│  Attacker sends multipart/form-data with Next-Action header │
└──────────────────────┬──────────────────────────────────────┘
                       │
                       ▼
┌─────────────────────────────────────────────────────────────┐
│  Server deserializes payload via React Flight protocol      │
└──────────────────────┬──────────────────────────────────────┘
                       │
                       ▼
┌─────────────────────────────────────────────────────────────┐
│  Fake chunk object with __proto__ pollution processed       │
└──────────────────────┬──────────────────────────────────────┘
                       │
                       ▼
┌─────────────────────────────────────────────────────────────┐
│  Blob handler invokes _formData.get(_prefix + id)           │
└──────────────────────┬──────────────────────────────────────┘
                       │
                       ▼
┌─────────────────────────────────────────────────────────────┐
│  Resolves to Function("malicious_code")                     │
└──────────────────────┬──────────────────────────────────────┘
                       │
                       ▼
┌─────────────────────────────────────────────────────────────┐
│  Arbitrary code executed with Node.js process privileges    │
└─────────────────────────────────────────────────────────────┘

🚀 Installation

Requirements

• Python 3.7 or higher
• requests library

Setup

# Clone the repository
git clone https://github.com/yourusername/react2shell-poc.git
cd react2shell-poc

# Install dependencies
pip install -r requirements.txt

# Make script executable (Linux/macOS)
chmod +x react2shell.py

Requirements.txt

requests>=2.31.0
urllib3>=2.0.0

💻 Usage

Basic Usage

python3 react2shell.py

Interactive Session

╔═══════════════════════════════════════════════════════════╗
║           React2Shell (CVE-2025-55182) PoC                ║
║                 CVSS 10.0 - Critical RCE                  ║
║                                                           ║
║  Affected: React 19.0.0, 19.1.0, 19.1.1, 19.2.0          ║
║           Next.js ≥14.3.0-canary.77, 15.x, 16.x          ║
║                                                           ║
║  Cerberus Secure - Lab Use Only                          ║
╚═══════════════════════════════════════════════════════════╝

[?] Enter target information:
    Host (e.g., localhost or 192.168.1.100): localhost
    Port (e.g., 3000): 3000

[React2Shell]> id
[*] Target: http://localhost:3000/
[*] Command: id
[*] Building exploit payload...
[*] Sending exploit request...
[+] Response Status Code: 200
[*] Parsing response...

╔═══════════════════════════════════════════════════════════╗
║                    COMMAND OUTPUT                         ║
╚═══════════════════════════════════════════════════════════╝
uid=1000(node) gid=1000(node) groups=1000(node)

[React2Shell]> whoami
[React2Shell]> pwd
[React2Shell]> ls -la
[React2Shell]> exit

Example Commands

# System reconnaissance
[React2Shell]> id
[React2Shell]> whoami
[React2Shell]> uname -a
[React2Shell]> cat /etc/os-release

# File system exploration
[React2Shell]> pwd
[React2Shell]> ls -la
[React2Shell]> cat package.json

# Environment variables (often contain secrets)
[React2Shell]> printenv
[React2Shell]> echo $PATH

# Network information
[React2Shell]> ifconfig
[React2Shell]> netstat -tulpn

Available Commands

🛡️ Detection

Network-Level Detection (Snort v3)

Deploy this Snort rule to detect exploitation attempts:

alert http any any -> $LAN_NETWORK any (
    msg:"Potential Next.js React2Shell / CVE-2025-55182 attempt";
    flow:to_server,established;
    content:"Next-Action"; http_header; nocase;
    content:"multipart/form-data"; http_header; nocase;
    pcre:"/Content-Disposition:\s*form-data;\s*name=\"0\"/s";
    pcre:"/\"status\"\s*:\s*\"resolved_model\"/s";
    pcre:"/\"then\"\s*:\s*\"\$1:__proto__:then\"/s";
    classtype:web-application-attack;
    sid:6655001;
    rev:1;
)

Detection Logic:

• Monitors for Next-Action header (RSC-specific)
• Detects multipart/form-data payloads
• Identifies exploit-specific patterns: name="0", status: "resolved_model", then: "$1:__proto__:then"

Endpoint Detection (OSQuery)

Use this OSQuery rule to scan for vulnerable package versions:

{
  "queries": {
    "detect_react2shell_vulnerable_packages": {
      "query": "SELECT name, version, path FROM npm_packages WHERE (name='react-server-dom-parcel' AND (version='19.0.0' OR (version >= '19.1.0' AND version < '19.1.2') OR version='19.2.0')) OR (name='react-server-dom-turbopack' AND (version='19.0.0' OR (version >= '19.1.0' AND version < '19.1.2') OR version='19.2.0')) OR (name='react-server-dom-webpack' AND (version='19.0.0' OR (version >= '19.1.0' AND version < '19.1.2') OR version='19.2.0'));",
      "interval": 3600,
      "description": "Detects vulnerable versions of React Server Components packages affected by CVE-2025-55182",
      "platform": "linux,windows,macos",
      "version": "1.0"
    }
  }
}

Benefits:

• Scans endpoints for vulnerable packages
• Works in development, staging, and production environments
• Can be integrated into CI/CD pipelines
• Provides early warning before deployment

Log Analysis Indicators

Look for these patterns in your application logs:

- HTTP POST requests with "Next-Action" header
- Unusual multipart/form-data requests to application root
- Error messages containing "NEXT_REDIRECT" with unexpected digest values
- Spike in 500 errors with React-related stack traces
- Child process spawning from Node.js (execSync, spawn, exec)

🔧 Remediation

Immediate Actions

1. Update Vulnerable Packages

# Check current versions
npm list react-server-dom-webpack react-server-dom-parcel react-server-dom-turbopack

# Update React to patched version
npm install [email protected] [email protected]

# Update Next.js to latest patched version
npm install next@latest

# Verify updates
npm list react react-dom next

2. Verify Application Rebuild

# Clear cache and rebuild
rm -rf .next node_modules package-lock.json
npm install
npm run build

3. Deploy Updated Applications

• Development: Test thoroughly in staging environment
• Staging: Validate all functionality before production
• Production: Deploy with appropriate rollback plan

Long-Term Security Measures

1. Implement Web Application Firewall (WAF) Rules

Block suspicious patterns:

- Requests with "Next-Action" header from untrusted sources
- Multipart form data with suspicious JSON structures
- Requests matching exploit signature patterns

2. Network Segmentation

• Isolate React applications in separate network zones
• Implement strict egress filtering
• Monitor and alert on unusual outbound connections

3. Runtime Application Self-Protection (RASP)

• Deploy RASP solutions to detect and block exploitation attempts
• Monitor for suspicious child process spawning
• Alert on unexpected code execution patterns

4. Security Scanning in CI/CD

# Example GitHub Actions workflow
name: Security Scan
on: [push, pull_request]

jobs:
  dependency-check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Check for vulnerable React packages
        run: |
          npm audit --audit-level=critical
          npm list react-server-dom-webpack react-server-dom-parcel react-server-dom-turbopack

5. Monitoring and Alerting

Set up alerts for:

• Deployment of vulnerable package versions
• Exploitation attempt patterns in logs
• Unexpected child process creation
• Network connections to suspicious destinations

🧪 Lab Environment Setup

Option 1: Vulnerable Next.js Application

# Create a new Next.js app with vulnerable version
npx [email protected] vulnerable-app
cd vulnerable-app

# Install vulnerable React version
npm install [email protected] [email protected]

# Start the development server
npm run dev

Option 2: Docker Environment

Create a Dockerfile:

FROM node:18-alpine

WORKDIR /app

# Create a basic Next.js app
RUN npx [email protected] vulnerable-app --typescript --tailwind --app --no-src-dir

WORKDIR /app/vulnerable-app

# Install vulnerable React versions
RUN npm install [email protected] [email protected]

EXPOSE 3000

CMD ["npm", "run", "dev"]

Build and run:

docker build -t react2shell-lab .
docker run -p 3000:3000 react2shell-lab

Option 3: Docker Compose

Create docker-compose.yml:

version: '3.8'
services:
  vulnerable-app:
    build: .
    ports:
      - "3000:3000"
    environment:
      - NODE_ENV=development
    volumes:
      - ./app:/app/vulnerable-app

Run:

docker-compose up -d

Verify Vulnerability

Test with curl:

curl -X POST http://localhost:3000/ \
  -H "Next-Action: x" \
  -H "Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryx8jO2oVc6SWP3Sad" \
  --data-binary @exploit_payload.txt

📚 References

Official Security Advisories

• React Security Advisory - CVE-2025-55182
• Next.js Security Advisory
• NVD - CVE-2025-55182

Research and Analysis

• Original PoC by maple3142
• Wiz Security Research - React2Shell Analysis
• Assetnote Security Research

Detection and Mitigation

• Snort Documentation
• OSQuery Documentation
• React Server Components Documentation

Related Vulnerabilities

• Log4Shell (CVE-2021-44228) - Similar RCE through deserialization
• Spring4Shell (CVE-2022-22965) - Framework-level RCE

🤝 Contributing

Contributions are welcome! Please follow these guidelines:

1. Fork the repository
2. Create a feature branch (git checkout -b feature/improvement)
3. Commit your changes (git commit -am 'Add new detection method')
4. Push to the branch (git push origin feature/improvement)
5. Create a Pull Request

Areas for Contribution

• Additional detection rules (Suricata, Zeek, etc.)
• Integration with security frameworks (MISP, TheHive, etc.)
• Enhanced payload variations
• Improved output parsing
• Additional documentation and translations

📝 License

This project is licensed under the MIT License - see the LICENSE file for details.

👤 Author

Tinashe

• Position: Cybersecurity Solutions Architect
• Organization: Cerberus Secure / iConnect SA
• Location: Johannesburg, South Africa
• LinkedIn: https://www.linkedin.com/in/tinashe-matanda/
• GitHub: @tinashelorenzi

About Cerberus Secure

Cerberus Secure is the cybersecurity division of iConnect SA, specializing in:

• DDoS mitigation and network security
• GRC compliance (POPIA, ECT, PCI-DSS, HPCSA)
• Security architecture and solution design
• Incident response and threat intelligence
• Custom SIEM development (Olympus platform)

🙏 Acknowledgments

• maple3142 - Original proof-of-concept research
• Wiz Security Research - Comprehensive vulnerability analysis
• Assetnote - Enhanced exploitation techniques
• React Team - Rapid response and patch development
• Next.js Team - Framework-level mitigation implementation

⚖️ Responsible Disclosure

This vulnerability was responsibly disclosed by security researchers to the React team. This PoC is released after:

• Official patches have been made available
• Sufficient time for organizations to update
• Public disclosure by the React security team

Timeline:

• December 2025: Vulnerability discovered
• December 2025: Coordinated disclosure to React team
• December 2025: Patches released (19.0.1, 19.1.2, 19.2.1)
• December 2025: Public disclosure and PoC release

Remember: Use this tool responsibly and only on systems you are authorized to test.

For questions, concerns, or security issues with this repository, please open an issue or contact the maintainer directly.