Lachlan Davidson

Metasploit · Author

Source-scoped identity with 1 associated PoC and 2 linked vulnerabilities.

Showing 1 PoC on this page

Metasploit

Unauthenticated RCE in React Server Components (React2Shell)

Metasploit exploitby Maksim RogovAdded to Metasploit 2025-12-09ExploitCVE-2025-55182CVE-2025-664781 file

exploit_multi/http/react2shell_unauth_rce_cve_2025_55182 · Ruby

MetasploitPoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Metasploit exploit module that achieves unauthenticated remote code execution (RCE) in React Server Components by sending crafted multipart requests to exploit prototype pollution during deserialization (CVE-2025-55182). It supports Next.js and Waku frameworks on Unix and Windows targets.

Backdoor review

No backdoor observed in reviewed code

The reviewed Metasploit module source code implements a public exploit for CVE-2025-55182 (React2Shell). It constructs and sends HTTP requests to achieve remote code execution on vulnerable React Server Components endpoints. No concealed backdoor, deceptive payload, or operator-directed harm beyond the stated exploit behavior was observed.

ClassificationExploit
Model confidence100%
AuthenticationNot required
Languagesruby
Target softwareReact Server ComponentsNext.jsWaku
Attack typesremote code executionprototype pollutiondeserialization of untrusted data
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The module is a complete Metasploit exploit that constructs and sends malicious HTTP requests to achieve remote code execution. It includes an 'exploit' method that executes a payload via child_process.exec, and is classified as an exploit module in its metadata.

modules/exploits/multi/http/react2shell_unauth_rce_cve_2025_55182.rb:6modules/exploits/multi/http/react2shell_unauth_rce_cve_2025_55182.rb:182-184modules/exploits/multi/http/react2shell_unauth_rce_cve_2025_55182.rb:1

Requirements

  • Target must be running a vulnerable version of React Server Components (19.0.0, 19.1.0, 19.1.1, 19.2.0) with an exposed Server Function endpoint.modules/exploits/multi/http/react2shell_unauth_rce_cve_2025_55182.rb:37-40

Observed behavior

  • Sends a POST request with a multipart/form-data body containing a malicious JSON chunk that uses '__proto__', 'constructor', or 'prototype' as module names to trigger prototype pollution during RSC payload deserialization.modules/exploits/multi/http/react2shell_unauth_rce_cve_2025_55182.rb:188-201modules/exploits/multi/http/react2shell_unauth_rce_cve_2025_55182.rb:203-221
  • Executes an arbitrary command payload on the target server by invoking child_process.exec with the attacker-supplied command.modules/exploits/multi/http/react2shell_unauth_rce_cve_2025_55182.rb:182-184
  • Performs a vulnerability check for Next.js by sending a payload that triggers a redirect with a random ID, and for Waku by detecting framework markers in the response body.modules/exploits/multi/http/react2shell_unauth_rce_cve_2025_55182.rb:156-163modules/exploits/multi/http/react2shell_unauth_rce_cve_2025_55182.rb:166-178
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Payload withheldThis is the documented exploit behavior for CVE-2025-55182. The module uses the Metasploit payload framework to deliver a command payload.modules/exploits/multi/http/react2shell_unauth_rce_cve_2025_55182.rb:184
Payload Execution
Payload withheldStandard Metasploit exploit pattern: the module executes the user-selected payload on the target. No additional hidden commands are injected.modules/exploits/multi/http/react2shell_unauth_rce_cve_2025_55182.rb:184
Check Method
Payload withheldCheck methods are non-destructive and only verify vulnerability presence. No backdoor behavior.modules/exploits/multi/http/react2shell_unauth_rce_cve_2025_55182.rb:156-179
Review boundaries

What the analysis did not establish

  • Analysis is based on module source code and metadata only; Metasploit framework mixins, libraries, and external payloads are not included.
  • The code was not executed; classification is based on static analysis of the artifact's intended purpose.
  • Only the module source file was reviewed; Metasploit framework mixins, libraries, and external payloads are not expanded and were not analyzed.
  • Binary files were not present in the evidence.
  • The review does not assess the safety or reliability of the module or its payloads.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.