CVE-2025-55184_Testing

Python script for testing CVE-2025-55184

---

CVE-2025-55184 – React Server Components DoS Scanner

A safe, security validation script designed to detect CVE-2025-55184, a denial-of-service (DoS) vulnerability affecting React Server Components (RSC).

This tool is intended strictly for internal security testing and controlled assessments. It must only be used against systems you own or are explicitly authorized to test.

---

Overview

CVE-2025-55184 - Denial of Service (DoS) Severity: HIGH | CVSS Score: 7.5

CVE-2025-55184 impacts the deserialization logic used by React Server Components. A specially crafted RSC payload can cause the server to enter an infinite resolution loop, leading to denial of service.

This condition may result in:

• Excessive CPU consumption
• Application hang or crash
• Service unavailability for legitimate users

This scanner sends a non-destructive validation payload to the standard RSC endpoint and evaluates server behaviour (response time and timeout conditions) to determine whether the target appears vulnerable.

---

Affected Packages

According to the official React security advisory, the vulnerability affects the following packages:

• react-server-dom-webpack
• react-server-dom-parcel
• react-server-dom-turbopack

---

Affected Versions

The following versions are vulnerable:

• 19.0.0 – 19.0.2
• 19.1.0 – 19.1.2
• 19.2.0 – 19.2.2

These vulnerabilities are present in the same release lines as CVE-2025-55182. Earlier patch attempts were incomplete and did not fully remediate all DoS vectors.

---

Fixed Versions (Verified)

React has officially backported fixes to the following versions:

• 19.0.3
• 19.1.4
• 19.2.3

Immediate upgrade is required if you are running any affected version listed above.

---

What This Tool Does

• Sends a controlled React Server Components deserialization payload
• Targets the default /_rsc endpoint
• Measures response latency and timeout behavior
• Identifies potential infinite deserialization loop conditions
• Reports a clear Vulnerable or Not Vulnerable result

The tool does not exploit, persist, modify, or extract data from the target system.

---

Installation

Clone the repository:

git clone https://github.com/KkHackingLearning/CVE-2025-55184_Testing.git
cd CVE-2025-55184_Testing

Install dependencies:

pip install requests

Requirements:

• Python 3.8+

---

Usage

Single Target Scan

python3 scanner.py -d http://example.com:3000

---

Example Output

------------------------------------------------------------
   CVE-2025-55184 | React Server Components DoS Scanner
------------------------------------------------------------

Testing http://example.com
Response OK (#s)

Scan Summary
http://example.com -> Not Vulnerable or Vulnerable

---

Interpreting Results

• Not Vulnerable
  Target responds normally within expected time limits.

• Vulnerable
  Target response is significantly delayed or times out, indicating a potential infinite deserialization loop.

---

Command-Line Options

Option	Description
-d, --domain	Single target domain or IP
--timeout	Request timeout in seconds (default: 5)
-v, --verbose	Enable debug-level output

---

Safety & Authorization Notice

⚠ IMPORTANT

This tool must only be used against systems that you own or are Explicitly Authorized to Test.

Unauthorized testing may violate:

• Organizational security policies
• Local or international laws
• Terms of service agreements

The author assumes no liability for misuse of this tool.

---

Author - _K

~ CyberSecurity Researcher_

---

License

This project is provided for internal security testing and research purposes only.