30 lines (22 loc) · 911 Bytes

CVE-2025-55182 // REACT SERVER COMPONENTS RCE

[ OVERVIEW ] Exploit PoC for CVE-2025-55182. Targets unsafe versions and input validation functions vulnerabilities in React Server Components.

[ TECHNICAL MECHANISM ]

Vector : Prototype pollution via $1:proto:then during hydration.
Payload : RCE via process.mainModule.require('child_process').
Exfil : Data leakage through X-Action-Redirect headers.

[ REQUIREMENTS ]

python3
requests

[ STRATEGIES ]

standard : Direct child_process execution.
obfuscated : Hex encoding bypass feature for basic WAF pattern matching.

[ DISCLAIMER ] For authorized security research and educational purposes only.

[ USAGE ]

Basic check

python3 exploit.py -t -c "id"

WAF bypass attempt

python3 exploit.py -t -c "cat /etc/passwd (RCE Command)" -s obfuscated