https://bokkapig.pages.dev/tags/cve-2025-55182/Recent content in CVE-2025-55182 on bokkapigHugoen-gbTue, 04 Aug 2026 14:45:21 +0100https://bokkapig.pages.dev/writeups/reactor/Tue, 04 Aug 2026 14:45:21 +0100https://bokkapig.pages.dev/writeups/reactor/A ReactorWatch monitoring dashboard on port 3000 runs Next.js 15.0.3 with React 19.0.0 — vulnerable to React2Shell (CVE-2025-55182 / CVE-2025-66478), an unauthenticated RCE in the React Server Components Flight deserializer. A POST to / carrying a Next-Action header and a forged circular Flight chunk reaches Function via $1:constructor:constructor, giving code execution as the node service account. The app’s world-readable SQLite database yields engineer’s MD5 password hash, reused verbatim for SSH. Root comes from a root-owned uptime-monitor systemd unit launched with –inspect=127.0.0.1:9229: the Node debug port is an unauthenticated root eval primitive, driven over the Chrome DevTools Protocol.