From React2Shell to the Hall of Fame | How I Exploited a React RCE

My name is Ali Ayaz, and I'm a security researcher from Pakistan. In this write-up, I'm sharing my experience of exploiting the React2Shell vulnerability and earning a Hall of Fame recognition from the American company IONOS for reporting a P1 vulnerability [ Severity: Important ]

Bug:- React2Shell Remote Code Execution

Let's start the journey!!!

So, I had been testing IONOS for the last two days, looking for valid bugs. At first, I found only a few P5 issues.

While testing, I noticed that IONOS was using Next.js. I checked the Next.js versions I could identify, and everything seemed to be up to date.

I decided to dig a little deeper and started enumerating subdomains. And guess what? I found one subdomain that was running Next.js 15.5.6, which was vulnerable.

I did some more research and found that Next.js 15.5.6 was affected by the React2Shell vulnerability. At that point, I decided to see if I could actually exploit it on the target.

I downloaded the react2shell-ultimate tool from GitHub and ran the following command in my terminal:

python3 react2shell-ultimate.py - god -u "https://*****.ionos.**/" - cmd "id"

python3 react2shell-ultimate.py - god -u "https://*****.ionos.**/" - cmd "id"

Boom! I was able to execute commands remotely on the target.

We all know most bug bounty programs don't really consider vulnerabilities demonstrated only with automated tools, so I decided to dig deeper and exploit the vulnerability manually.

I did more R&D and found a way to exploit it without relying on the automated tool. So, I decided to give it a try.

First, I sent a GET request to the website, intercepted the request in Burp Suite, and sent it to Repeater. From there, I modified the request by replacing the GET request with this POST request and sent the request.

And boom! I was honestly surprised when it worked, and I successfully achieved remote code execution.

I immediately reported the vulnerability to the IONOS security team. After reviewing and validating the issue, they confirmed the vulnerability and added my name to their Hall of Fame program.

Reference:

React2Shell (CVE-2025-55182) A 10.0 critical severity vulnerability affecting server-side use of React.js, tracked as CVE-2025-55182 in React.js…