vuln-app-CVE-2025-55182

Intentionally vulnerable Next.js application demonstrating CVE-2025-55182 RCE via unsafe deserialization in React Server Components. Includes exploit scripts and scanner integration for security research and education.

• Node.js 18+
• npm or yarn
• Python 3.9+ (for react2shell-scanner, optional)

🚀 Setup

1. Install dependencies:

2. Run the development server:

The application will be available at http://localhost:3000

🧪 Testing the Vulnerability

Method 1: Using the Included Exploit Script

The repository includes curl_id.sh, a command-line tool based on the Nuclei template for exploiting CVE-2025-55182.

Usage:

Options:

• -d, --domain: Target domain/URL (default: http://localhost:3000)
• -c, --command: Command to execute (default: id)

Method 2: Using react2shell-scanner

1. Clone the scanner tool:

2. Run the scanner:

3. Use safe check mode (no RCE execution):

Method 3: Manual Testing

The vulnerability can be exploited by sending a crafted multipart POST request to the server with:

• Next-Action: x header
• X-Nextjs-Request-Id header
• X-Nextjs-Html-Request-Id header
• A malicious multipart form payload that exploits the deserialization vulnerability

See the react2shell-scanner repository for the exact payload structure.

🔍 How It Works

The vulnerability exists in React Server Components' deserialization mechanism. When Next.js processes server actions, it deserializes the request payload. The vulnerable versions of React (19.0.0-19.2.0) do not properly validate or sanitize the deserialized data, allowing attackers to:

1. Craft malicious payloads that exploit prototype pollution
2. Execute arbitrary code on the server via process.mainModule.require('child_process').execSync()
3. Achieve remote code execution without authentication
4. Retrieve command output in the X-Action-Redirect response header

Technical Details

The exploit uses a prototype pollution attack in the JSON deserialization process. The payload structure includes:

• A then property that pollutes the prototype chain
• A _response object with a _prefix field containing JavaScript code
• The code executes via execSync() and redirects output to the response header

🛡️ Remediation

To fix this vulnerability:

1. Update React to version 19.2.1 or later:

2. Update Next.js to the latest version:

3. Review and update all dependencies:

4. Verify the fix by running the scanner again - it should no longer detect the vulnerability

📁 Project Structure

📚 References

• CVE-2025-55182 Details
• react2shell-scanner
• React Security Advisory
• Next.js Security Advisory
• Vercel Changelog
• Original PoC by maple3142

⚖️ Legal Disclaimer

This application is created solely for security research and educational purposes.

• DO NOT use this application in production environments
• DO NOT deploy this application to public servers
• DO NOT use this to attack systems without explicit authorization
• DO use this only in isolated, controlled environments for learning

The authors and contributors are not responsible for any misuse of this code. Unauthorized access to computer systems is illegal and may result in criminal prosecution.

🤝 Contributing

This is an educational repository. Contributions that improve documentation, add better examples, or enhance the educational value are welcome.

📝 License

This project is provided for educational purposes. Use at your own risk.

🙏 Credits

• Assetnote Security Research Team - Original vulnerability research and scanner tool
• maple3142 - Original RCE PoC disclosure
• xEHLE_ - RCE output reflection in response header
• Nagli - Additional research contributions
• ProjectDiscovery - Nuclei template for detection

Remember: This is a vulnerable application. Use responsibly and only in controlled environments for security research and education.