gagaltotal/tot-react-rce-CVE-2025-55182

GitHubRepository PoCScanner

PoC files

32 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python-based tool that checks for CVE-2025-55182 (React Server Components RCE) by sending HTTP requests to target URLs and optionally providing an interactive shell. The main.py script orchestrates scanning of single or multiple targets, while the README describes it as a 'Next.js tool' for the vulnerability.

Backdoor review

No backdoor observed in reviewed code

The reviewed text files (README.md, main.py, requirements.txt) constitute a command-line tool for testing CVE-2025-55182. main.py imports standard modules and project modules, parses arguments, and dispatches to either a vulnerability check or an interactive shell. No obfuscation, concealed payloads, persistence mechanisms, credential theft, or unrelated remote access behavior is present in the supplied evidence.

ClassificationScanner
Model confidence95%
AuthenticationNot required
LanguagesPython
Target softwareReact Server ComponentsNext.js
Attack typesDeserialization of Untrusted Data
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact's primary operation is checking for the presence of CVE-2025-55182 by sending HTTP requests to targets. The main.py script calls run_checks to perform vulnerability detection and offers an interactive shell only as an optional mode. The README describes it as a 'tool' for the CVE. No exploit payload or deserialization gadget is present in the supplied text files; the core exploitation logic resides in uninspected modules (http_client, etc.). The artifact is therefore classified as a scanner.

main.py:51-63README.md:1-3

Requirements

  • Target URL(s) must be provided via -u or -l arguments.main.py:23-28
  • Python dependencies aiohttp, requests, termcolor, tabulate must be installed.requirements.txt:1-4

Observed behavior

  • Parses command-line arguments including target URL, list of URLs, proxy, custom headers, and shell mode.main.py:11-16
  • Runs vulnerability checks against provided URLs using run_checks function.main.py:51-63
  • Optionally enters an interactive shell on a target when --shell flag is used.main.py:33-43
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Import
from http_client import run_checks, interactive_shell_entryThe interactive shell entry point is imported but its implementation is not included in the reviewed files; its behavior cannot be confirmed from the supplied evidence.main.py:5
Review boundaries

What the analysis did not establish

  • Only 3 of 32 repository files were provided as text; the remaining 29 files (including http_client.py, cli.py, and other modules that likely contain the actual vulnerability check and shell logic) were omitted.
  • The evidence does not include the actual HTTP requests, payloads, or deserialization techniques used to detect or exploit CVE-2025-55182.
  • The interactive shell entry point is referenced but its implementation is not included in the supplied text.
  • Only 3 of 30 text files were included; the interactive shell implementation (http_client.py) and other modules are absent.
  • Two non-text media files (699,759 bytes) and 27 unclassified files were not analyzed.
  • Binary files were flagged as metadata-only and not inspected.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

2