l0n3m4n Exploits and Proofs of Concept

Showing 6 PoCs on this page

GitHub

l0n3m4n/CVE-2025-55182-Waf

Repository PoC2Created 2025-12-06ExploitCVE-2025-551828 files

213.4 KiB

Analysisdeepseek-v4-pro:cloud · 2026-08-11

Technical assessment

A Python script (CVE-2025-55182.py) that both scans for and exploits CVE-2025-55182, a pre-authentication RCE vulnerability in React Server Components. It sends crafted multipart POST requests to execute arbitrary shell commands on vulnerable Next.js/React servers and includes features for reverse shells and WAF bypass.

Backdoor review

No backdoor observed in reviewed code

The reviewed evidence consists of a public CVE-2025-55182 proof-of-concept scanner and exploit tool. All supplied text files (Python script, YAML template, README, and requirements) implement expected vulnerability scanning and exploitation behavior against the stated target (React Server Components / Next.js). No concealed backdoor, unrelated payload, credential theft, persistence mechanism, or operator-directed harm was observed. The tool sends crafted HTTP requests to user-supplied targets to test for and exploit the CVE; it does not contact attacker-controlled infrastructure or perform actions beyond the user's explicit commands.

ClassificationExploit

Model confidence100%

AuthenticationNot required

LanguagesPython

Target softwareReact Server ComponentsNext.jsreact-server-dom-webpackreact-server-dom-turbopackreact-server-dom-parcel

Attack typesRemote Code ExecutionDeserialization of Untrusted Data

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact (CVE-2025-55182.py) contains code that constructs and sends payloads designed to execute arbitrary operating system commands on a remote target, which is the definition of an exploit. While it also includes a scanning mode, the core and most prominent functionality is exploitation, including command execution and reverse shell delivery.

CVE-2025-55182.py:195-196CVE-2025-55182.py:360-365CVE-2025-55182.py:367-411

Requirements

Target must be running a vulnerable version of React Server Components (19.0.0, 19.1.0, 19.1.1, 19.2.0) or a framework like Next.js that uses them.CVE-2025-55182.py:27
The target's Server Function endpoint must be reachable over HTTP/HTTPS.CVE-2025-55182.py:235-236

Observed behavior

Constructs a multipart form-data payload containing a serialized JavaScript object that, when deserialized by the vulnerable server, executes an arbitrary shell command via Node.js's child_process.execSync.CVE-2025-55182.py:195-221
Sends the crafted payload as a POST request to the target URL with a 'Next-Action: x' header, which triggers the vulnerable Server Function handler.CVE-2025-55182.py:250-251CVE-2025-55182.py:486-488
Extracts the command output from the server's error response (e.g., from a 'digest' field in a redirect error) and displays it to the user.CVE-2025-55182.py:335-347
Includes a reverse shell feature that sends a bash or PowerShell one-liner to connect back to an attacker-controlled listener.CVE-2025-55182.py:367-411
Offers WAF bypass techniques, including prepending random junk data to the multipart body and encoding the payload in UTF-16LE.CVE-2025-55182.py:171-175CVE-2025-55182.py:225-229

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Payload: Payload withheldThe Python script constructs JavaScript payloads that execute arbitrary shell commands on the target server via Node.js child_process. This is the documented exploit mechanism for CVE-2025-55182.CVE-2025-55182.py:195CVE-2025-55182.py:210
Reverse Shell Payload: Payload withheldThe tool includes functionality to send reverse shell payloads to a target, which is a standard post-exploitation technique for RCE vulnerabilities.CVE-2025-55182.py:393
Network Behavior: Payload withheldAll network activity is directed at targets specified by the user via command-line arguments (-u or -f). No hardcoded exfiltration endpoints or beaconing to third-party servers are present.CVE-2025-55182.py:233-258CVE-2025-55182.py:260-278
Author Contact: Payload withheldAuthor contact information is present in the README but does not constitute backdoor behavior.README.md:21-22

Review boundaries

What the analysis did not establish

The evidence includes two non-text media files (assets/wafbypass_encoding.webp and assets/uft-16LE.png) that were not analyzed.
The evidence includes two text files (linux_revshell.sh and windows_revshell.ps1) that are referenced but whose content was not provided in the packet.
The analysis is based solely on static review of the provided source code; the code was not executed, and its effectiveness or safety is not verified.
Two non-text media files (assets/wafbypass_encoding.webp, assets/uft-16LE.png) totaling 165,957 bytes were flagged as metadata-only and not analyzed for content. They appear to be screenshots referenced in the README.
Two additional text files (linux_revshell.sh, windows_revshell.ps1) referenced in the Python script and README were not included in the selected text evidence and could not be reviewed.
The review is limited to static analysis of the supplied text; no dynamic execution or behavioral analysis was performed.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHub