trax69/cve-2025-55182-poc
Proof of Concept for CVE-2025-55182 ("React2Shell"). A fully dockerized environment demonstrating Remote Code Execution (RCE) via insecure deserialization in React Server Components. Includes vulnerable targets for both Vanilla React (Express) and Next.js, along with a custom Python exploit script.
⚠️ DISCLAIMER: EDUCATIONAL USE ONLY This repository contains functional exploit code for a critical vulnerability (CVSS 10.0). It is intended strictly for academic research, security analysis, and educational purposes. Do not use this code against systems you do not own or have explicit permission to test. The author is not responsible for any misuse.
This project documents and demonstrates CVE-2025-55182, a critical Remote Code Execution (RCE) vulnerability residing in the React Server Components (RSC) architecture. Often referred to as "React2Shell", this flaw allows unauthenticated remote attackers to execute arbitrary code on the server by manipulating the "Flight" serialization protocol used by react-server.
This laboratory provides a controlled, isolated Docker environment to analyze the vulnerability in two distinct scenarios:
react-server-dom-webpack and Express.The environment is orchestrated via Docker Compose and consists of three isolated containers connected by a private internal network (research-net).
| Service | Context | Description | Vulnerable Component |
|---|---|---|---|
vanilla-target | vanilla-rsc/ | Minimal Express server manually implementing the RSC protocol. | [email protected] |
nextjs-target | nextjs-app/ | Standard Next.js application using App Router. | [email protected] (impl. react-server) |
attacker | exploit/ | Python environment containing the exploit scripts. | N/A |
The vulnerability stems from Insecure Deserialization (CWE-502) within the Flight protocol parser. By injecting a crafted multipart payload containing a "fake" chunk structure, an attacker can:
.then property of a promise-like object.$B blobs).Function() constructor to compile and execute arbitrary JavaScript (e.g., child_process.execSync).Clone the repository:
git clone https://github.com/trax69/cve-2025-55182-poc.git
cd cve-2025-55182-poc
Build and launch the laboratory:
docker-compose up -d --build
Wait for the containers to fully initialize. The Next.js container may take a few minutes to complete its first build.
The exploitation logic is encapsulated in exploit/exploit.py. You can run attacks from your host machine (if Python is installed) or directly from the attacker container.
Access the attacker shell:
docker-compose exec attacker bash
Install requeriments:
pip install -r requirements.txt
Attack Target A (Vanilla React):
python exploit.py http://vanilla-target:4000/rsc vanilla
Attack Target B (Next.js):
python exploit.py http://nextjs-target:3000/ nextjs
The exploit attempts to create a file named pwned.txt inside the /tmp directory of the victim server. To verify success:
# Check Vanilla Server
docker-compose exec vanilla-target ls -la /tmp/pwned.txt
# Check Next.js Server
docker-compose exec nextjs-target ls -la /tmp/pwned.txt
If successful, you will see the file listing. If the exploit fails, the file will not exist.
To remediate this vulnerability in production environments:
react-server-dom-webpack (and related packages) to version 19.0.1, 19.1.2, or 19.2.1+."$1:__proto__" or unusual usages of "$@" in multipart bodies.University Project - Security Audit & Vulnerability Research