CVE-2025-55182 Modular Exploit with WAF Bypass

A Python script providing an interactive shell for exploiting the critical RCE vulnerability (CVE-2025-55182) in vulnerable React Server Components and Next.js applications. This exploit targets the deserialization flaw that allows unauthenticated remote code execution. It includes a modular system for adding WAF bypass techniques.

[!NOTE] This exploit is designed to interact with the vulnerable RSC protocol endpoint. Execution results are captured via the server's response mechanism. Commands resulting in no output will return (empty).

[!CAUTION] This code is for research and educational purposes only. It is intended to help understand, detect, and remediate the CVE-2025-55182 vulnerability. Do not use it against systems without explicit authorization.

The use of this script is at the user's own risk, and the author(s) assume no responsibility for any misuse or unintended consequences.

By using this code, the user acknowledges and agrees to the following:

• The user is solely responsible for any legal consequences arising from the use of this script.
• The user will not hold the author(s) liable for any damages, losses, or legal actions resulting from the use of this code.
• The user agrees to comply with all applicable laws and regulations.
• The user acknowledges that using this script against systems without permission may violate laws and terms of service, potentially leading to severe penalties.
• The user is advised to consult their own legal counsel before using this code.

Vulnerability Details

• CVE ID: CVE-2025-55182 (React Server Components)
• Related CVE: CVE-2025-66478 (Next.js downstream impact)
• Severity: Critical (CVSS 10.0)
• Description: Unauthenticated Remote Code Execution (RCE) vulnerability in React Server Components, affecting applications using Next.js App Router with vulnerable React versions.
• Affected React Versions: 19.0, 19.1.0, 19.1.1, 19.2.0
• Affected Next.js Versions: 15.x, 16.x, 14.3.0-canary.77+
• Patched React Versions: >= 19.0.1, >= 19.1.2, >= 19.2.1
• Patched Next.js Versions: 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7

WAF Bypass Modules

This exploit features a dynamic WAF bypass module system. Modules are stored in the waf_modules directory as separate Python files. Each module must define a modify_request(body, headers) function that takes the default request body and headers, modifies them as needed for the bypass, and returns the new body, headers.

• Adding a Module: Create a new Python file (e.g., bypass_custom.py) in the waf_modules directory containing the modify_request function.
• Using a Module: Run the script with the --help flag to see available bypass options (e.g., --bypass-custom for bypass_custom.py). Use the corresponding flag to activate the module.

Example: A bypass_vercel.py module is included as an example, implementing techniques potentially effective against Vercel deployments.

Advanced Session Configuration (--modify-request)

The script allows direct modification of certain attributes of the requests.Session object used for making HTTP requests. This provides granular control over aspects like SSL verification, timeouts, and potentially other session-level settings.

• Usage: Use the --modify-request <KEY> <VALUE> flag. The <KEY> corresponds to an attribute of the requests.Session object (e.g., verify, timeout).
• Type Conversion: The script attempts basic type conversion for <VALUE>: true/false become booleans, numeric strings become integers or floats, otherwise it remains a string.
• Specific Example - SSL Verification:
  • To enable SSL verification: --modify-request verify True
  • To disable SSL verification: --modify-request verify False (equivalent to the old --insecure flag)
• Help: Use python CVE-2025-55182.py --help-modify-request for a tree-like visualization of common options.

Prerequisites

• Python 3.x
• Required Python libraries (see requirements.txt)

Setup

1. Install Python dependencies: It's recommended to use a virtual environment (e.g., python -m venv venv and source venv/bin/activate on Unix-like systems or venv\Scripts\activate on Windows).
   root@kitploit:~

   pip install -r requirements.txt
   

2. Create the waf_modules directory:
   root@kitploit:~

   mkdir waf_modules
   

   Place your WAF bypass module files (e.g., bypass_vercel.py) inside this directory.

Running the Exploit

1. Set up a vulnerable environment (for testing only):

   root@kitploit:~

   docker run --rm -p 127.0.0.1:3000:3000 ghcr.io/l4rm4nd/cve-2025-55182:latest
   

   More information: https://github.com/l4rm4nd/CVE-2025-55182

2. Execute the script:

   root@kitploit:~

   python CVE-2025-55182.py --help # To see all options, including WAF bypasses
   # Example with a bypass module:
   python CVE-2025-55182.py --host 127.0.0.1 --port 3000 --endpoint / --bypass-vercel
   

   If not using command-line arguments, the script will prompt interactively for host, port, and endpoint.

3. Interact with the shell:

   • Type commands and press Enter to execute them on the target system.
   • Type exit or quit to terminate the shell session.