/
← Voltar ao feed
medium exploit público

Vercel React2Shell WAF bypass challenge: five parser-differential bypasses of CVE-2025-55182 protections found by Hacktron

1 fonte(s) · 1 atualização(ões) · publicado 03/05/2026 21:00 · coletado há 1 dia

Researchers at Hacktron (author ginoah) described five bypasses of the Vercel WAF rules protecting against React2Shell (CVE-2025-55182), a pre-auth RCE in React Server Functions affecting Next.js 15.x–16.0.6 and other React-based frameworks. The bypasses were found during a Vercel bounty challenge. Per Vercel's writeup, 116 researchers took part, 20 unique bypass techniques were validated, and over $1 million was paid out, of which Hacktron earned $170k. All the bypasses exploit parser differentials between the WAF and the busboy multipart parser in the backend. Vercel iteratively patched the WAF and finally moved to raw-body matching, which removes the parsing differentials at some cost in performance and false positives. The author stresses that WAFs are only a stopgap and that patching the underlying bug remains the first priority.

Technical Details

  • WAF logic inferred by black-box testing: ignores data outside the multipart boundary, JSON-unescapes form values and blocks on :constructor. It passes the request through if parsing fails and allows any content when filename is present.
  • Bypass 1: duplicate boundary= parameter in Content-Type. The WAF used the second boundary and ignored the body, while the backend used the first.
  • Bypass 2: non-UTF8 bytes in any header made the WAF parser fail, so it forwarded the request unsanitized.
  • Bypass 3: charset=utf16le in a multipart field. busboy decodes it as UTF-16, hiding :constructor from the WAF's raw-byte scan.
  • Bypass 4: duplicate per-field Content-Type headers. The WAF read charset=utf8, while busboy used the first (utf16le).
  • Bypass 5: a --y-- end marker with a trailing space at the start of the body. The WAF treated the form as ended and ignored the rest, while the backend treated it as garbage.
  • The proof-of-concept payload uses prototype pollution (__proto__:then, constructor:constructor) and process.mainModule.require('child_process').execSync, with output leaked via a NEXT_REDIRECT digest.
  • Final WAF flow: strip <0x00> bytes from the raw body, JSON-unescape it twice, and block if "_response"\s*: or :constructor appears.
  • In a post-challenge experiment, LLMs given white-box access (Coraza WAF plus a vulnerable Next.js 16 backend) and probing tools rediscovered all of the manual bypasses. Black-box attempts were ineffective.
  • Vercel reported the WAF blocked over 6 million exploit attempts in the weeks after disclosure.

Remediation

  • Patch React and Next.js and the other affected frameworks and bundlers; do not rely on a WAF alone.
  • Treat WAF rules as temporary mitigation. Prefer raw-body matching over parsed-field matching to avoid WAF and backend parser differentials.
  • Normalize or reject ambiguous requests, such as duplicate boundary or Content-Type parameters, non-UTF8 header bytes and non-UTF8 charsets in multipart fields.

Exploit público

Há código de exploração publicado no Exploit-DB para CVE-2025-55182. O código não é reproduzido aqui: o link leva à fonte, e a explicação foi escrita pela IA a partir do arquivo publicado.

  1. exploit-db.com · EDB-52506 ↗ · aplicação web · multiple · pub. 09/04/2026 não verificado

    React Server 19.2.0 - Remote Code Execution

    The script targets CVE-2025-55182, a flaw in how React Server Components deserialize data sent to server function endpoints, as used by frameworks such as Next.js. An unauthenticated attacker with network access to an app running React 19.0.0 to 19.2.0 can trigger it with one crafted POST, no user interaction. It abuses object handling to run JavaScript on the server, giving command execution as the app user. It is a working-looking, blind PoC that scans a target list and leaks command output via DNS lookups; it only prints HTTP status.

    CVE-2025-55182 · autor: danieljavanrad · explicação gerada por IA

Linha do tempo

  1. hacktron.ai ↗ · pub. 03/05/2026 21:00 · coletado 19/10 18:03 primeiro registro

    Vercel React2Shell WAF bypass challenge: five parser-differential bypasses of CVE-2025-55182 protections found by Hacktron

    ler a análise desta fonte

    Researchers at Hacktron (author ginoah) described five bypasses of the Vercel WAF rules protecting against React2Shell (CVE-2025-55182), a pre-auth RCE in React Server Functions affecting Next.js 15.x–16.0.6 and other React-based frameworks. The bypasses were found during a Vercel bounty challenge. Per Vercel's writeup, 116 researchers took part, 20 unique bypass techniques were validated, and over $1 million was paid out, of which Hacktron earned $170k. All the bypasses exploit parser differentials between the WAF and the busboy multipart parser in the backend. Vercel iteratively patched the WAF and finally moved to raw-body matching, which removes the parsing differentials at some cost in performance and false positives. The author stresses that WAFs are only a stopgap and that patching the underlying bug remains the first priority.

    Technical Details

    • WAF logic inferred by black-box testing: ignores data outside the multipart boundary, JSON-unescapes form values and blocks on :constructor. It passes the request through if parsing fails and allows any content when filename is present.
    • Bypass 1: duplicate boundary= parameter in Content-Type. The WAF used the second boundary and ignored the body, while the backend used the first.
    • Bypass 2: non-UTF8 bytes in any header made the WAF parser fail, so it forwarded the request unsanitized.
    • Bypass 3: charset=utf16le in a multipart field. busboy decodes it as UTF-16, hiding :constructor from the WAF's raw-byte scan.
    • Bypass 4: duplicate per-field Content-Type headers. The WAF read charset=utf8, while busboy used the first (utf16le).
    • Bypass 5: a --y-- end marker with a trailing space at the start of the body. The WAF treated the form as ended and ignored the rest, while the backend treated it as garbage.
    • The proof-of-concept payload uses prototype pollution (__proto__:then, constructor:constructor) and process.mainModule.require('child_process').execSync, with output leaked via a NEXT_REDIRECT digest.
    • Final WAF flow: strip <0x00> bytes from the raw body, JSON-unescape it twice, and block if "_response"\s*: or :constructor appears.
    • In a post-challenge experiment, LLMs given white-box access (Coraza WAF plus a vulnerable Next.js 16 backend) and probing tools rediscovered all of the manual bypasses. Black-box attempts were ineffective.
    • Vercel reported the WAF blocked over 6 million exploit attempts in the weeks after disclosure.

    Remediation

    • Patch React and Next.js and the other affected frameworks and bundlers; do not rely on a WAF alone.
    • Treat WAF rules as temporary mitigation. Prefer raw-body matching over parsed-field matching to avoid WAF and backend parser differentials.
    • Normalize or reject ambiguous requests, such as duplicate boundary or Content-Type parameters, non-UTF8 header bytes and non-UTF8 charsets in multipart fields.