RSC Surface & Crash Detector

This tool is a non-intrusive security detection script designed to identify exposed React Server Components (RSC) surfaces and verify crash-based vulnerability behavior related to:

• CVE-2025-55182
• CVE-2025-66478

It is intended for defensive security testing, WAF validation, and application hardening workflows.

This script does not perform exploitation or command execution. It strictly performs detection and classification.

Features

• Automatic scanning over:
  • http://
  • https://
• Redirect-aware requests (follows 30x responses)
• RSC surface detection using protocol fingerprints
• Crash-based vulnerability probing using non-destructive payloads
• Always performs both surface and crash checks independently
• Supports:
  • Target list input
  • Proxy routing
  • TLS verification bypass
• Clean terminal output with per-target status
• Final output:
  • Domain-only
  • Deduplicated
  • Only confirmed vulnerable domains

Detection Logic

Each target is evaluated using two independent mechanisms.

RSC Surface Detection

A target is marked as EXPOSED if any of the following is observed:

• Content-Type: text/x-component response
• React digest error fingerprint in the response body
• Minified React error signature
• React error reference URLs

If the server returns:

• HTTP 500 with Next.js indicators → marked as SUSPICIOUS

If none of the above are observed → marked as SAFE

Crash-Based Vulnerability Probe

A serialized multipart payload is sent to the target to evaluate server-side crash behavior.

Results are classified as:

• VULNERABLE
  • HTTP 500 with React digest or minified React error pattern
• UNKNOWN
  • HTTP 500 without a clear fingerprint
• NOT VULNERABLE
  • Any non-500 response

This probe is executed regardless of surface detection outcome to avoid false negatives.

Output Structure

For each target, the script prints:

RSC Surface Result

• [EXPOSED]
• [SUSPICIOUS]
• [SAFE]

Crash-Based Result

• [VULNERABLE]
• [UNKNOWN]
• [NOT VULNERABLE]

Installation

No external dependencies are required.

Make the script executable:

chmod +x rsc_detect.sh

Usage

Single Target

./rsc_detect.sh -u example.com
./rsc_detect.sh -u https://example.com

Target List

./rsc_detect.sh -l domains.txt

Proxy Support

./rsc_detect.sh -l domains.txt -p http://127.0.0.1:8080

TLS Verification Disable

./rsc_detect.sh -l domains.txt -k

Custom Timeout

./rsc_detect.sh -l domains.txt --timeout 15