RCE Vulnerability in React and Next.js

Re:RCE Vulnerability in React and Next.js by ejpir on Wednesday December 03, 2025 @04:18PM (#46140272)

I'm fumbled around a bit and got it working, but not entirely sure if this is how it really works: have a look at https://github.com/ejpir/CVE-2025-55182-poc

[ Parent | on HN ]

Re:RCE Vulnerability in React and Next.js by WatchDog on Wednesday December 03, 2025 @07:47PM (#46142412)

I ran your exploit-rce-v4.js with and without the patched react-server-dom-webpack, and both of them executed the RCE.

So I don't think this mechanism is exactly correct, can you demo it with an actual nextjs project, instead of your mock server?

[ Parent | on HN ]

Re:RCE Vulnerability in React and Next.js by ejpir on Wednesday December 03, 2025 @08:00PM (#46142515)

I'm trying that, nextjs is a little different because it uses a Proxy object before it passes through, which blocks the rce.

I'm debugging it currently, maybe I'm not on the right path after all \0/

[ Parent | on HN ]

Re:RCE Vulnerability in React and Next.js by ejpir on Wednesday December 03, 2025 @08:40PM (#46142771)

I'v updated the code, try it now with server-realistic.js:

1. npm start 2. npm run exploit

[ Parent | on HN ]

Re:RCE Vulnerability in React and Next.js by croemer on Wednesday December 03, 2025 @06:21PM (#46141678)

Thanks for the writeup, it's incredible!

[ Parent | on HN ]

Re:RCE Vulnerability in React and Next.js by croemer on Thursday December 04, 2025 @06:20AM (#46146316)

The PoC is AI generated crap - sorry for the initial comment lauding it. I should have checked better. See: https://github.com/ejpir/CVE-2025-55182-poc/issues/1 and https://react2shell.com/

[ Parent | on HN ]

Re:RCE Vulnerability in React and Next.js by slopfighter on Thursday December 04, 2025 @12:48AM (#46144204)

Your lump of AI-generated slop has detracted from the response to an important vulnerability. Congratulations. Your PoC is invalid and you should delete it.

[ Parent | on HN ]

Re:RCE Vulnerability in React and Next.js by jondwillis on Thursday December 04, 2025 @01:49AM (#46144536)

HMU, proud owner of slopcop.ai and have been itching to put it to good use.

[ Parent | on HN ]

Re:RCE Vulnerability in React and Next.js by orkj on Thursday December 04, 2025 @01:09AM (#46144314)

very interesting to read.

However, if I am reading this correctly, your PoC falls in the category described here: https://react2shell.com/

> Anything that requires the developer to have explicitly exposed dangerous functionality to the client is not a valid PoC. Common examples we've seen in supposed "PoCs" are vm#runInThisContext, child_process#exec, and fs#writeFile.

> This would only be exploitable if you had consciously chosen to let clients invoke these, which would be dangerous no matter what. The genuine vulnerability does not have this constraint. In Next.js, the list of server functions is managed for you, and does not contain these.

Context: This is from Lachlan Davidson, the reporter of the vulnerability

[ Parent | on HN ]

Re:RCE Vulnerability in React and Next.js by slop-cop on Thursday December 04, 2025 @05:13AM (#46145879)

The guy who discovered the actual vulnerability says otherwise.

Delete this distraction to genuine blue teamers and stop shitting up the information landscape with this utter hogwash.

This is why infosec is dead.

https://react2shell.com/

https://github.com/ejpir/CVE-2025-55182-poc/issues/1#issueco...

[ Parent | on HN ]

Re:RCE Vulnerability in React and Next.js by lionkor on Thursday December 04, 2025 @07:55AM (#46147134)

FYI as of just now, the author has (correctly) added a disclaimer that this poc doesnt quite work.

[ Parent | on HN ]