🥊 PunchingBag - CVE-2025-55182 Security Research Platform

⚠️ EDUCATIONAL PURPOSE ONLY: This is an intentionally vulnerable application designed for authorized security research and CTF challenges. Do NOT use these techniques on unauthorized systems.

A deliberately vulnerable Next.js 15.1.6 application that demonstrates CVE-2025-55182 (React2Shell) - a critical Remote Code Execution vulnerability in React Server Components. Built for security researchers, penetration testers, and students to practice exploitation techniques in a safe, isolated environment.

• About CVE-2025-55182
• Features
• Prerequisites
• Installation
• Usage
• CTF Challenges
• Exploitation Guide
• Project Structure
• Security Notice
• Contributing
• License
• Acknowledgments

CVE-2025-55182, also known as React2Shell, is a critical Remote Code Execution (RCE) vulnerability affecting React Server Components in Next.js.

• CVE ID: CVE-2025-55182
• Type: Remote Code Execution (RCE)
• CVSS Score: 10.0 (Critical)
• Affected Versions: Next.js 15.1.6 and earlier with React Server Components enabled
• Attack Vector: Unsafe deserialization in RSC Flight protocol
• Impact: Complete system compromise, data exfiltration, privilege escalation

The vulnerability stems from improper handling of serialized data in React Server Actions. Attackers can craft malicious payloads that bypass validation and execute arbitrary code on the server through:

1. Prototype pollution in JavaScript objects
2. Unsafe deserialization of React Flight payloads
3. Server Action parameter manipulation
4. Header injection in Server Components

• 🐳 Fully Dockerized - Complete isolation from host system
• 🎯 5 CTF Flags - Progressive difficulty challenges
• 🔓 Multiple Attack Vectors - Server Actions, API routes, authentication bypass
• 📚 Educational Resources - Built-in hints and exploitation guides
• 🛡️ Safe Environment - No risk to production systems
• 🎨 Realistic Application - Realistic app theme with admin panel
• 📊 Progress Tracking - Monitor your flag captures
• 🔧 Vulnerable Version of React and Next.js - React 19.0.0, Next.js 15.1.6

Before you begin, ensure you have the following installed:

• Docker: Version 20.10 or higher
• Docker Compose: Version 2.0 or higher
• Git: For cloning the repository

docker --version
docker-compose --version
git --version

# 1. Clone the repository
git clone https://github.com/Machine-farmer/PunchingBag-for-React2Shell.git
cd PunchingBag-for-React2Shell

# 2. Build and run with Docker
docker-compose up --build

# 3. Access the application
# Open your browser to: http://localhost:3000

# 1. Clone the repository
git clone https://github.com/Machine-farmer/punchingbag-cve-2025-55182.git
cd punchingbag-cve-2025-55182

# 2. Install dependencies
npm install

# 3. Run development server
npm run dev

# 4. Access at http://localhost:3000

⚠️ Warning: Manual setup without Docker is NOT recommended for security research. Always use Docker for isolation.

# Start the vulnerable application
docker-compose up

# Start in detached mode (background)
docker-compose up -d

# View logs
docker-compose logs -f

# Stop containers
docker-compose down

# Stop and remove volumes
docker-compose down -v

# Complete cleanup (removes images)
docker-compose down -v --rmi all

Once running, navigate to:

• Homepage: http://localhost:3000
• Dashboard: http://localhost:3000/dashboard
• Admin Panel: http://localhost:3000/admin

PunchingBag contains 5 hidden flags that test different exploitation techniques:

All flags follow the format: CTF{description_here}

• Flag 1: Explore the application structure and dashboard
• Flag 2: Look for Server Actions that accept user input
• Flag 3: Check environment variables for credentials
• Flag 4: Exploit the RCE vulnerability in admin console
• Flag 5: Extract hidden configuration data

• Burp Suite - HTTP request interception and modification
• curl - Command-line HTTP client for payload crafting
• Browser DevTools - Network traffic inspection
• Postman - API testing (optional)

# Explore the application
curl http://localhost:3000

# Check available endpoints
curl http://localhost:3000/dashboard
curl http://localhost:3000/admin

Intercept form submissions and modify the payload:

// Example malicious payload
{
  "name": "attacker",
  "email": "test@example.com",
  "message": "__proto__: { isAdmin: true }"
}

# Inject malicious headers
curl -X POST http://localhost:3000/api/data \
  -H "Content-Type: application/json" \
  -H "x-user-data: {\"role\":\"admin\"}" \
  -d '{"exploit": true}'

Check .env.local for credentials or exploit the authentication:

# Default admin token (intentionally weak)
Username: admin
Token: super_secret_admin_key_12345

On vulnerable component use the command execution feature:

# Simulate RCE
Command: cat /flag.txt

• Prototype Pollution: Inject __proto__ properties
• RSC Payload Crafting: Modify React Flight serialized data
• Session Hijacking: Manipulate authentication tokens
• API Fuzzing: Test all endpoints for vulnerabilities

punchingbag-cve-2025-55182/
├── app/
│   ├── actions.js              # Vulnerable Server Actions
│   ├── layout.js               # Application layout
│   ├── page.js                 # Homepage with CTF info
│   ├── globals.css             # Global styles
│   ├── admin/
│   │   └── page.js            # Admin panel (Flag 3, 4)
│   ├── dashboard/
│   │   └── page.js            # User dashboard (Flag 1, 2)
│   └── api/
│       ├── data/
│       │   └── route.js       # API endpoint
│       └── submit/
│           └── route.js       # Form submission endpoint
├── components/
│   ├── Logo.js                # Application logo
│   ├── VulnerableForm.js      # Exploitable form component
│   └── UserDisplay.js         # User profile display
├── lib/
│   └── flags.js               # Flag management
├── public/
│   └── boxing-bag.png         # Application icon
├── .env.local                 # Environment variables (Flag 5)
├── docker-compose.yml         # Docker configuration
├── Dockerfile                 # Container definition
├── next.config.js             # Next.js configuration
├── package.json               # Dependencies
└── README.md                  # This file

This application is INTENTIONALLY VULNERABLE and designed for:

✅ Authorized Uses:

• Security research and education
• Penetration testing skill development
• CTF competitions and training
• Academic coursework in cybersecurity
• Vulnerability assessment practice

❌ Prohibited Uses:

• Testing on systems without explicit authorization
• Production deployments of any kind
• Malicious attacks on real systems
• Distribution of exploitation tools for illegal purposes

• Always obtain written permission before testing systems you don't own
• Follow responsible disclosure practices for real vulnerabilities
• Comply with local laws and regulations regarding security testing
• Respect terms of service of all systems and platforms

• ALWAYS run in Docker for proper isolation
• NEVER expose port 3000 to public internet
• Use only in controlled lab environments
• Stop/Destroy containers after research sessions

# Proper cleanup after use
docker-compose down -v --rmi all

Contributions are welcome! Please follow these guidelines:

1. Fork the repository
2. Create a feature branch (git checkout -b feature/AmazingFeature)
3. Commit your changes (git commit -m 'Add some AmazingFeature')
4. Push to the branch (git push origin feature/AmazingFeature)
5. Open a Pull Request

• Add new exploitation challenge
• Improve documentation
• Create video tutorials
• Add new vulnerability demonstrations
• Enhance UI/UX
• Write automated exploitation scripts

• Be respectful and professional
• Focus on educational value
• Do not add malicious code
• Test thoroughly before submitting

This project is licensed under the MIT License - see the LICENSE file for details.

• Boxing bag icon from Flaticon (Free license with attribution)

• Next.js Team - For the framework (and patching the vulnerability)
• React Team - For React Server Components
• Security Researchers - Who discovered and disclosed CVE-2025-55182
• CTF Community - For inspiration and methodology
• OWASP - For security testing guidelines

• OWASP Top 10
• PortSwigger Web Security Academy

• Issues: GitHub Issues
• Discussions: GitHub Discussions

• Initial release
• 5 CTF challenges
• Docker support
• Complete documentation

If this project helped you learn about web security, please consider giving it a star! ⭐