Anuththara Wickramasekara

Posted on Sep 24

Weaponizing a CVSS 10.0 PoC: Building a Zero-Touch RSC Recon Engine with GitHub Copilot

#mlhacks #devchallenge #hackathon

This is a submission for the MLH x DEV Writing Challenge

Every security researcher has a "Project Graveyard" - a dusty local directory where dormant Proof of Concepts (PoCs), 2 AM exploit scripts, and ephemeral bypasses go to die.

For me, that script was a raw, 50-line Python snippet authored in December 2025. A CVSS 10.0 vulnerability (CVE-2025-55182 / React2Shell) had just dropped, exposing a critical unauthenticated Remote Code Execution (RCE) attack vector via unsafe deserialization of the React Flight protocol.

My script successfully fingerprinted the vulnerability, but its architecture was archaic: synchronous, entirely ephemeral, and reliant on manual DevTools injection to scan a target DOM. It was a functional PoC, but terrible for actual field reconnaissance.

When the MLH Finish-Up-a-Thon launched, I decided to pull this script out of the archive and operationalize it. Armed with GitHub Copilot as my autonomous platform engineer, I spent 48 hours transforming a brittle terminal script into a highly resilient, event-driven, Manifest V3 Chrome Extension.

Here is how we turned digital duct tape into a production-grade vulnerability reconnaissance asset.

What I Built: The RSC Reconnaissance Engine

I engineered the RSC Fingerprint Detector, a Manifest V3 (MV3) Chrome extension designed for passive and active telemetry gathering on React Server Components (RSC) and the React2Shell deserialization vulnerability class.

To eliminate false positives during target enumeration, the extension deploys a strict, dual-phase heuristic pipeline:

Passive Reconnaissance (Zero-Touch): Silently hooks the global execution context (window.__next_f), performs script asset introspection (react-server-dom-webpack), utilizes DOM attribute scanning (data-rsc), and monitors network traffic for specific HTTP response headers (Vary: RSC).
Active Probing: Fires a cross-origin, asynchronous fetch with a crafted X-RSC-Probe header payload. It then parses the resulting content-type entropy to extract the exact React Flight protocol signature without triggering target backend alerts.

The Architecture Upgrade: We migrated from a synchronous, single-vector Python script that lost its execution context on page reload, to a declarative MV3 architecture. The new engine features IndexedDB ACID transactions for persistent telemetry, cross-context Inter-Process Communication (IPC), and DOM isolation via Shadow DOM to prevent CSS cross-contamination.

Telemetry & Visual Proof

GitHub Repository: anuththara2007-W/CVE-2025-55182-Exploit-extension

There is nothing quite as satisfying as the visual proof of operationalizing a raw exploit script into a deployable tool.

December 2025 (The Ephemeral PoC)	May 2026 (The Operationalized Asset)

Raw console execution. Highly manual. Zero state persistence.	Isolated UI, real-time threat badges, and active CVE mapping.

Partner Technologies: GitHub Copilot as a Cyber-Operations Ally

Writing the core heuristic logic for vulnerability detection is the fun part. Wrestling with Chrome’s restrictive Content Security Policies (CSP), isolated execution worlds, and MV3 lifecycle deprecations is the grueling friction that kills side projects.

Without GitHub Copilot, this asset would still be a dormant script. I didn't just use it for autocomplete; I utilized it as a senior platform architect who understood the Chrome Sandbox limitations intimately. Here is how Copilot acted as an elite force multiplier:

1. Bypassing the Manifest V3 Sandbox Constraints
Background pages are dead in MV3. Copilot flawlessly orchestrated my manifest.json schema, registering the Service Worker and migrating my network interception logic to declarativeNetRequest instead of the blocking webRequest API. It completely bypassed the dreaded "persistent flag" runtime errors that plague MV3 migrations.

2. Bridging the Asynchronous IPC Gap
When setting up chrome.runtime.sendMessage across isolated execution contexts (content script to background worker), Copilot automatically injected the mandatory return true directive inside the onMessage listener.

The Technical Impact: In MV3, failing to return true immediately terminates the IPC message channel, causing silent failures for asynchronous callbacks. Copilot patched this race condition before the code even compiled.

3. Architecting Persistent Telemetry
I needed persistent local storage for scan logs but wanted to avoid bloated wrapper libraries. Copilot generated a raw IndexedDB implementation from scratch, engineering the onupgradeneeded handler, object store schemas, and timestamp indexing. It proactively wrapped the database transactions in try/catch blocks, implementing idempotency and retry logic for transient database lock errors.

The "Mic-Drop" Network Interception

The most impressive moment occurred while configuring the passive packet-sniffing logic. I wrote a single comment:
// Capture RSC responses via webRequest

Copilot instantly synthesized this interception block:

chrome.webRequest.onHeadersReceived.addListener(
  function(details) {
    const isRSC = details.responseHeaders.some(h => 
      h.name.toLowerCase() === 'content-type' && h.value.includes('text/x-component')
    );
    if (isRSC) {
      saveFlight(details); // Trigger telemetry extraction
    }
  },
  { urls: ["<all_urls>"] },
  ["responseHeaders"] // <-- Copilot successfully identified this mandatory MV3 bypass!
);

Injecting "responseHeaders" into the extraInfoSpec array is an obscure, critical MV3 security requirement. If omitted, Chrome silently sanitizes the headers from your extension's execution context. Copilot's deep contextual awareness of Chrome's security model saved me hours of debugging silent telemetry drops.

Hackathon Experience

Participating as a Solo Developer in the MLH Finish-Up-a-Thon completely shifted my perspective on software development in the security space.

Standard hackathons prioritize reckless velocity-getting a prototype to compile by any means necessary. This event prioritized craftsmanship and operational readiness. It forced me to analyze the "last mile" of software engineering: error boundaries, state persistence, UI reactivity, and adhering to strict platform security models.

We often abandon security research tools because the friction of engineering a deployable interface outweighs the adrenaline of writing the initial exploit logic. GitHub Copilot eradicated that friction. It handled the exhausting platform boilerplate, allowing me to focus 100% of my cognitive load on the vulnerability architecture.

My biggest takeaway? A dead PoC doesn't have to stay in the graveyard. With the right AI tooling and a structured deadline, you can resurrect a forgotten script and weaponize it into a professional-grade asset.

Disclaimer: This reconnaissance tool is intended strictly for authorized vulnerability scanning, threat intelligence, and educational purposes. Use only on infrastructure you own or have explicit, documented authorization to test.

DEV Community