Jenderal92/CVE-2025-55182-React2shell

GitHubRepository PoCExploit

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python 2.7 script that exploits CVE-2025-55182, a pre-authentication RCE vulnerability in React Server Components, by sending a crafted multipart request to execute arbitrary system commands on a target Next.js server and extracting the output from the redirect response.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a Python 2.7 exploit script (CVE-2025-55182.py) and its README.md. The script sends crafted HTTP requests to exploit CVE-2025-55182 (a React Server Components deserialization vulnerability) to achieve remote code execution. It provides an interactive shell and a mass-scanning mode. All behavior is consistent with a public proof-of-concept exploit for the stated CVE. No concealed executable behavior, persistence mechanisms, credential theft, unrelated payloads, or operator-directed harm beyond the declared exploit functionality were observed.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesPython
Target softwareNext.jsReact Server Components
Attack typesRemote Code ExecutionPrototype Pollution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively sends a malicious payload to a target server to achieve remote code execution, as demonstrated by the execute_cmd function that constructs and sends an exploit request and extracts command output. This is exploitation, not mere detection or scanning.

CVE-2025-55182.py:35-86README.md:3-4

Requirements

  • Target must be running a vulnerable version of React Server Components (19.0.0, 19.1.0, 19.1.1, 19.2.0) with a Server Function endpoint.CVE-2025-55182.py:1
  • Python 2.7 and the 'requests' library must be installed on the attacker's machine.README.md:22-26

Observed behavior

  • Sends a crafted multipart/form-data POST request to the target URL (appending '/login' if path is empty) with specific headers (Next-Action, X-Nextjs-Request-Id, X-Nextjs-Html-Request-Id) and a JSON payload that exploits prototype pollution to inject a malicious JavaScript prefix.CVE-2025-55182.py:35-75
  • The injected prefix uses child_process.execSync to execute an attacker-supplied system command and throws an error containing the command output in a redirect digest.CVE-2025-55182.py:46-47
  • Extracts the command output from the 'x-action-redirect' response header by parsing the '/login?a=' parameter.CVE-2025-55182.py:76-84
  • Provides an interactive shell for a single target, allowing repeated command execution, and a mass scan mode that tests multiple URLs from a file using multithreading.CVE-2025-55182.py:143-191CVE-2025-55182.py:103-141
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Mechanism
Crafted multipart/form-data POST request with prototype pollution payload targeting Next.js Server Function endpointThe script constructs a payload that abuses __proto__:then and constructor:constructor to inject a malicious _prefix containing child_process.execSync() for command execution, consistent with the described CVE-2025-55182 vulnerability.CVE-2025-55182.py:35-86
Command Execution
Executes arbitrary system commands on the target server via the exploitThe execute_cmd function sends the crafted payload and extracts command output from the x-action-redirect header. The interactive_shell and mass_scan functions allow user-supplied commands to be executed on vulnerable targets.CVE-2025-55182.py:35-86CVE-2025-55182.py:143-191CVE-2025-55182.py:88-101
Network Communication
Sends HTTP POST requests to target URLs with exploit payloadThe script uses the requests library to send the exploit payload to the target. It sets specific headers (Next-Action, X-Nextjs-Request-Id) required for the vulnerability.CVE-2025-55182.py:66-75
File Output
Writes vulnerable target URLs and command output to a local file (default res.txt)In mass scan mode, the script appends the domain and command output to a user-specified output file. This is standard logging for a scanning tool.CVE-2025-55182.py:95-99
Review boundaries

What the analysis did not establish

  • Review is limited to the two text files provided; no binary or non-text files were present in the artifact.
  • The script requires the 'requests' library, which is an external dependency not included in the artifact; its behavior is not reviewed here.
  • The artifact is a proof-of-concept exploit; its use against unauthorized targets is illegal, but the code itself contains no backdoor.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1