RSC | React2Shell Vulnerability Detector Edge extension security report

- Detects React Server Components (RSC) exposure and Next.js App Router behavior on the current page - Performs an active fingerprint (adds header RSC: 1) to observe server behavior safely - Offers an optional exploit probe to demonstrate potential RCE risk in vulnerable setups - Shows real-time alerts and updates the extension badge when risks are detected - Attempts to display React and Next.js versions when available Key Features - Passive Detection - Scans the loaded page for RSC indicators (e.g., Content-Type text/x-component, window.__next_f, react-server-dom-webpack) - Updates the badge and shows an alert if RSC indicators are found - Lists all matched patterns for quick review - Active Fingerprint (RSC:1) - Sends a safe GET request with header RSC: 1 - Checks response headers (Content-Type, Vary) and body structure for signs of React Flight Protocol - Triggers an alert on positive detection and displays details - RCE Exploit Probe (Advanced) - Sends a crafted multipart payload to test for command execution in vulnerable environments - Displays the decoded output if execution is successful - Intended for controlled, ethical security testing only - Framework Versions - React version: extracted via React DevTools hook or window.React.version when present - Next.js version: read from response header X-Nextjs-Version if exposed; falls back to “unknown” User Interface - Modern, compact dark theme - Sections: Passive Detection, Active Fingerprint, Framework Versions, RCE Exploit, Credits - Alerts appear when passive or active detection indicates RSC behavior - Badge shows “!” in red for detected risk on the current tab Usage - Navigate to a target page you control or have explicit permission to test - Open the extension popup from the toolbar - Review Passive Detection results (alerts fire on detection) - Click “Run Fingerprint” to probe with header RSC: 1 (alerts fire on detection) - Optionally use the RCE Exploit probe: enter a safe command (e.g., echo vulnerability_test) and click Execute - Review the console output and details lists to assess exposure Privacy & Safety - Operates only on the active tab and makes limited requests to the current page origin - Does not collect or transmit data to external servers - Exploit probe is disabled unless you actively run it; use only in authorized environments Limitations - Detection relies on runtime signals and headers; some production builds hide or strip version information - Framework versions may appear as “Unknown” when not exposed by the site - Fingerprint heuristics may yield false negatives/positives depending on server configuration Ethical Use - For security research, education, and testing on assets you own or are authorized to assess - Do not deploy against third-party sites without explicit permission - The authors and maintainers are not responsible for misuse Credits - Built by mejbankadr