⚛️ React2Shell: CVE-2025-55182 Vulnerable Lab

⚠️ WARNING: INTENTIONALLY VULNERABLE APPLICATION

This repository contains a Dockerized application specifically configured to be vulnerable to CVE-2025-55182 (React2Shell).

• DO NOT deploy this container in a production environment or on a public server exposed to the internet.
• DO NOT run this on a machine containing sensitive data without proper network isolation.
• This lab is strictly for educational purposes, security research, and CTF simulations.

🎯 Challenge Overview

This lab is designed as a Simple Web to Root scenario, perfect for beginners to practice vulnerability exploitation and basic privilege escalation.

• Difficulty: Easy (Beginner Friendly)
• Estimated Time: ~15 Minutes
• Objective: Exploit the RCE vulnerability to gain initial access, then escalate privileges to root.
• Flags to Capture:
  1. 🚩 User Flag: user.txt
  2. 🚩 Root Flag: root.txt

---

🔍 Vulnerability Analysis

React2Shell (CVE-2025-55182) is a maximum severity (CVSS 10.0) Critical Remote Code Execution (RCE) vulnerability found in React Server Components (RSC) and its downstream implementation in the Next.js framework.

The Flaw

The vulnerability exists in how React handles Server Actions. An unauthenticated attacker can execute arbitrary code on the server by sending a single, specially crafted HTTP request. This bypasses the intended security boundaries of Server Components.

Affected Components & Versions

Based on the official advisory, the following components are affected:

1. React Server DOM (Versions 19.0, 19.1.0, 19.1.1, 19.2.0)

• react-server-dom-webpack
• react-server-dom-parcel
• react-server-dom-turbopack

2. Next.js Framework

• Next.js 15.x.x: Initial release up to versions before the December 2025 patch.
• Next.js Canary: Experimental versions using React 19 beta/rc.

✅ Safe Configurations: Applications using React 18 (standard in Next.js 14 and below) are NOT AFFECTED by this specific vulnerability.

---

🚀 Lab Installation & Usage

This lab utilizes Docker to ensure a safe, isolated, and reproducible environment. No local Node.js setup is required.

Prerequisites

• Docker Desktop or Docker Engine.
• Docker Compose.

Quick Start

1. Clone the Repository

   root@kitploit:~

   git clone https://github.com/xxxTectationxxx/React2Shell-CVE-Lab.git
   cd React2Shell-CVE-Lab
   

2. Launch the Victim Container We pull the pre-configured image directly from Docker Hub (agus33ina/web3-portfolio:v1):

   root@kitploit:~

   docker compose up -d
   

3. Access the Target Open your browser or Burp Suite and navigate to:

   root@kitploit:~

   http://localhost:3000
   

4. Exploitation Notes

   • The application is running Next.js 15 with Server Actions enabled.
   • Use tools like Nuclei or manual payload crafting to test the vulnerability.

5. Shutdown

   root@kitploit:~

   docker compose down
   

---

🛠️ Technical Stack

• Vulnerable App: Web3 Portfolio (Next.js 15 / React 19 RC)
• Containerization: Docker (Alpine Linux Node.js 20)
• Port: 3000

📚 References

For a deeper dive into the exploit chain and technical details, refer to:

1. ProjectDiscovery CVE Library: https://cloud.projectdiscovery.io/library/CVE-2025-55182
2. Invicti Security Blog: React2Shell Critical RCE Analysis
3. React Official Blog: Critical Security Vulnerability in React Server Components

---

👤 Author

Maintained by Agus33ina.