zorejt/rust_cve-2025-55182Rust-based exploit tool for CVE-2025-55182, enabling remote code execution on react-server-dom-webpack servers via crafted multipart requests with interactive shell, file read, and command execution capabilities.
This project is a security research tool developed in Rust, targeting the Remote Code Execution (RCE) vulnerability present in [email protected]. The vulnerability allows an attacker to execute arbitrary code on a target server without authentication by crafting malicious Server Action requests.
The tool provides multiple exploitation methods:
vm module or child_process modulefs moduleThe tool constructs specially crafted multipart/form-data requests, leveraging the Action mechanism of React Server Components to inject a malicious payload into the $ACTION_0:0 field. The payload specifies a Node.js built-in module (e.g., vm#runInThisContext) to be invoked, thereby bypassing security restrictions and executing arbitrary code.
Disclaimer
This project is intended solely for cybersecurity research, vulnerability analysis, and educational purposes. It is designed to help users understand the relevant technical principles, raise security awareness, and enhance protective capabilities.
Before using this project, please read and agree to the following terms:
The developers assume no responsibility for any direct or indirect losses, legal liabilities, criminal liabilities, data corruption, or service interruptions arising from the use of this project.
By using this project, users voluntarily assume all risks, including but not limited to:
Users must comply with the laws and regulations of their country or region. If users engage in illegal operations during use, they bear full responsibility, and the developers shall not be liable.
All content of this project is provided solely as a technical research reference and is not guaranteed to be suitable for all environments. The developers do not promise to provide maintenance, updates, or technical support.
By using or continuing to use this project, you acknowledge that you have read, understood, and fully agree to all the terms of this disclaimer.