CVE-2025-66478 Proof of Concept

# 执行特定命令
node exploit.js <目标URL> <命令>

# 示例
node exploit.js http://localhost:3000 "whoami"

# 扫描目标应用程序中的 RSC 端点
node exploit.js <目标URL> --scan

# 示例
node exploit.js http://localhost:3000 --scan

.\setup-demo.ps1

chmod +x setup-demo.sh
./setup-demo.sh

# 1. 构建 Docker 镜像
docker-compose build

# 2. 启动容器
docker-compose up -d

# 3. 查看日志（可选）
docker-compose logs -f

# 基本测试
node exploit.js http://localhost:3000/_rsc "echo test"

# 执行命令
node exploit.js http://localhost:3000/_rsc "whoami"

# 扫描端点
node exploit.js http://localhost:3000 --scan

# 查看日志
docker-compose logs -f

# 停止环境
docker-compose down

# 停止并删除数据
docker-compose down -v

# 重启环境
docker-compose restart

# 测试目标应用程序
node test-vulnerability.js <目标URL>

# 示例
node test-vulnerability.js http://localhost:3000

# 搜索 Next.js 应用（通用）
body="NEXT_DATA" && body="version"

# 搜索 AI 相关应用（Dify 等）
body="NEXT_DATA" && (body="AI" || body="人工智能" || body="大模型" || body="LLM")

# 搜索 Dify 应用
body="NEXT_DATA" && (body="dify" || title="Dify" || body="dify.ai")

# 组合搜索
body="NEXT_DATA" && (body="AI" || body="人工智能") && domain="edu.cn"

# 搜索教育机构中的 Next.js 应用
(web.title="Next.js" OR web.body="NEXT_DATA") && domain="edu.cn"

Vulnerability Overview

CVE-2025-66478 is a critical Remote Code Execution (RCE) vulnerability affecting Next.js applications, stemming from insecure deserialization in the React Server Components (RSC) protocol. With a CVSS score of 10.0 (the highest possible), it allows unauthenticated attackers to execute arbitrary code on vulnerable servers through specially crafted HTTP requests.

Technical Details

Root Cause

The vulnerability originates from insecure deserialization logic in the upstream React implementation (CVE-2025-55182) and affects Next.js applications using App Router. The issue lies in React Server Components' "Flight" protocol, which is responsible for serializing and deserializing data between server and client.

Impact Scope

Affected Next.js Versions:

• Next.js 15.x
• Next.js 16.x
• Next.js 14.3.0-canary.77 and later canary releases

Unaffected Versions:

• Next.js 13.x
• Next.js 14.x stable releases
• Applications using Pages Router
• Edge Runtime

Attack Vector

An attacker only needs to send a specially crafted HTTP request containing malicious RSC payload to the target server. When the server processes this payload, due to insecure deserialization logic, the attacker-controlled data can influence server-side execution flow, leading to arbitrary JavaScript code execution.

Proof of Concept

Disclaimer

This tool is for educational purposes and security research only. Do not use on unauthorized systems. Any illegal activities using this tool are unrelated to the author.

Proof of Concept Script

exploit.js is a proof-of-concept script demonstrating how to construct and send malicious RSC payloads. This script includes the following functionalities:

1. Generate Malicious Payload: Construct RSC payloads that exploit the deserialization vulnerability
2. Send Attack Requests: Send malicious payloads to target servers
3. Vulnerability Scanning: Scan target applications for potentially vulnerable RSC endpoints

Usage

Basic Usage

# Execute specific command
node exploit.js <target-url> <command>

# Example
node exploit.js http://localhost:3000 "whoami"

Scan Mode

# Scan target application for RSC endpoints
node exploit.js <target-url> --scan

# Example
node exploit.js http://localhost:3000 --scan

Docker Demo Environment

To safely demonstrate and test this vulnerability, we provide a complete Docker demo environment containing a vulnerable Next.js application.

Prerequisites

• Docker and Docker Compose
• At least 2GB free disk space
• At least 1GB free memory

Quick Start

Method 1: Using Startup Script (Recommended)

Windows (PowerShell):

.\setup-demo.ps1

Linux/macOS:

chmod +x setup-demo.sh
./setup-demo.sh

Method 2: Manual Start

# 1. Build Docker image
docker-compose build

# 2. Start container
docker-compose up -d

# 3. View logs (optional)
docker-compose logs -f

Access Application

After starting, wait a few seconds, then access:

• Application: http://localhost:3000
• RSC Endpoint: http://localhost:3000/_rsc

Test Vulnerability

Use the provided exploit script to test the vulnerability:

# Basic test
node exploit.js http://localhost:3000/_rsc "echo test"

# Execute command
node exploit.js http://localhost:3000/_rsc "whoami"

# Scan endpoints
node exploit.js http://localhost:3000 --scan

Environment Information

The demo environment includes:

• Next.js: 15.0.4 (Vulnerable version)
• React: 19.0.0
• Node.js: 20 (Alpine Linux)
• Architecture: Uses App Router and Server Components

Management Commands

# View logs
docker-compose logs -f

# Stop environment
docker-compose down

# Stop and remove data
docker-compose down -v

# Restart environment
docker-compose restart

Security Notes

⚠️ Important Warnings:

1. Educational Purpose Only: This environment is for learning and security research only
2. Isolated Environment: Container runs in isolated network, but still be cautious
3. Don't Expose to Internet: Don't map ports to public IP
4. Clean Up After Use: Stop and remove containers after testing
5. Don't Use in Production: This configuration contains known security vulnerabilities

Testing Tool

test-vulnerability.js is a tool for detecting whether an application is affected by this vulnerability. It performs the following checks:

1. Version Check: Verify if the Next.js version is within the affected range
2. Endpoint Testing: Check for potentially vulnerable RSC endpoints in the application
3. Vulnerability Verification: Test for the vulnerability using safe payloads

Usage

# Test target application
node test-vulnerability.js <target-url>

# Example
node test-vulnerability.js http://localhost:3000

Remediation

Immediate Fix

1. Upgrade Next.js: Upgrade Next.js to the latest version, which includes a fix for this vulnerability

   root@kitploit:~

   npm install next@latest
   # or
   yarn upgrade next@latest
   # or
   pnpm update next@latest
   

2. Verify Fix: Use the test-vulnerability.js tool to verify the fix was successful

   root@kitploit:~

   node test-vulnerability.js <target-url>
   

Temporary Mitigations

If an immediate upgrade is not possible, consider the following temporary mitigations:

1. Use Pages Router: Migrate affected routes to Pages Router, which is not affected by this vulnerability

2. Enable Edge Runtime: Enable Edge Runtime for affected routes, which is not affected by this vulnerability

   root@kitploit:~

   // In page component or layout
   export const runtime = 'edge';
   

Technical Details

Vulnerability Mechanism

The vulnerability exploits insecure deserialization logic in React Server Components' "Flight" protocol. When a server receives an RSC request from a client, it deserializes the payload containing component data. Due to insufficient validation during deserialization, attackers can construct malicious payloads that cause the server to execute arbitrary JavaScript code.

Exploitation Conditions

To exploit this vulnerability, an attacker needs to:

1. Target an application using Next.js 15.x, 16.x, or 14.3.0-canary.77 and later
2. Target an application using App Router
3. Be able to send HTTP requests to the target server

Impact

Successful exploitation can lead to:

1. Remote Code Execution (RCE)
2. Full server control
3. Data exfiltration
4. Service disruption

References

• Next.js Security Announcements
• React Server Components Documentation
• CVE-2025-55182 Details