# React2Shell: Technical Deep-Dive & In-the-Wild Exploitation of CVE-2025-55182

Improper RSC payload deserialization in React Server Components lets attackers reach Function() constructor gadget and achieve unauthenticated RCE on Next.js/Waku/Vite servers.

- Payout: Real-world hack
- Severity: critical
- Program: React Server Components
- Credited: Wiz Research
- Disclosed: 2025-12-08
- CVE: CVE-2025-55182
- Write-up quality: 8/10
- Original: https://www.wiz.io/blog/nextjs-cve-2025-55182-react2shell-deep-dive
- Library page: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-nextjs-cve-2025-55182-react2shell-deep-dive
- Tags: domain:web3 impact:data-leak impact:rce kind:incident platform:threat-intel sev:critical tech:nextjs tech:nodejs technique:chained technique:source-review vuln:deserialization vuln:rce

**Target:** React Server Components / Next.js server action endpoint (next-action header)
**Root cause:** The RSC reply decoder lacks type checking when resolving chunk references, allowing attacker-supplied objects to substitute internal Response/Chunk structures and reach the Function() constructor via array constructor chains.
**Steps:**
1. Send POST to any Next.js app with header `next-action: <anything>`; body is parsed regardless of defined actions.
2. Craft chunked payload where `'4'._formData.get` = `$3:constructor:constructor` (Array->Function) and `'4'._prefix` = attacker JS.
3. Set `'1'._response` = `$4` and `'1'.value` = `{"then":"$3:map","0":{"then":"$B3"},"length":1}` to force promise chain resolution.
4. Decoder hits `case "B": response._formData.get(response._prefix + obj)` executing `Function(prefix+obj)`.
5. Resulting function is invoked by then-chain, running arbitrary JS in Node process.
**How found:** Researchers noted the PoC's potency stems from Next.js exposing RSC by default via the next-action header with no action name needed; they hypothesized the flaw is in the RSC decoder itself, not Next.js, and tested the PoC with minor tweaks on Waku and Vite RSC plugin, confirming broader reach.
**Exploitation:** Attackers hit internet-facing Next.js apps with the crafted RSC payload to get code execution in the Node runtime, then opened reverse shells, dumped env vars, harvested npm/AWS/Docker/SSH creds, queried IMDS at 169.254.169.254 for IAM creds, deployed XMRig miners, Sliver implants, and a fileless Node monkey-patch webshell on `/favicon.login.ico`.
**Escalation:** Chained RCE to cloud metadata credential theft for control-plane privesc, then cryptomining and persistent Sliver C2; also monkey-patched http.Server.prototype.emit for log-evasive persistence.
**Insight:** When a framework auto-enables a deserialization endpoint (e.g. next-action header), the bug lives in the shared decoder library, not the framework — port the PoC to sibling consumers (Waku, Vite RSC, custom decodeReply servers) by locating any endpoint that passes raw body to the decoder.