wulf-pulse/dev/CVE-2025-55182-React2Shell-Review.md

# CVE-2025-55182: React Server Components RCE (React2Shell)

## Executive Summary

**CVE ID:** CVE-2025-55182  
**Also Known As:** React2Shell  
**CVSS Score:** 10.0 (Critical)  
**Disclosure Date:** December 3, 2025  
**CISA KEV Added:** December 5, 2025  
**Active Exploitation:** Confirmed  

A pre-authentication remote code execution vulnerability exists in React Server Components that allows unauthenticated attackers to execute arbitrary code on the server via insecure deserialization of malicious HTTP requests.

---

## Affected Versions

### React Server Component Packages (Direct)

| Package | Vulnerable Versions | Patched Versions |
|---------|---------------------|------------------|
| react-server-dom-parcel | 19.0.0, 19.1.0, 19.1.1, 19.2.0 | 19.0.1, 19.1.2, 19.2.1+ |
| react-server-dom-turbopack | 19.0.0, 19.1.0, 19.1.1, 19.2.0 | 19.0.1, 19.1.2, 19.2.1+ |
| react-server-dom-webpack | 19.0.0, 19.1.0, 19.1.1, 19.2.0 | 19.0.1, 19.1.2, 19.2.1+ |

### Frameworks & Bundlers (Indirect)

| Framework/Bundler | Vulnerable Versions | Notes |
|-------------------|---------------------|-------|
| Next.js | 14.3.0-canary, 15.x, 16.x (App Router) | Upgrade to 14.2.35+ or latest stable |
| React Router | RSC mode versions | Upgrade react-server-dom-* packages |
| Waku | Versions using RSC | Check dependencies |
| @parcel/rsc | RSC implementations | Check dependencies |
| @vite/rsc-plugin | RSC implementations | Check dependencies |
| rwsdk (RedwoodSDK) | RSC implementations | Check dependencies |

---

## Technical Details

### Vulnerability Mechanism

The vulnerability resides in the RSC Flight protocol implementation. The server processes RSC payloads unsafely, allowing attacker-controlled data to influence server-side execution logic through deserialization.

**Attack Vector:**
- Single malicious HTTP POST request
- No authentication required
- No user interaction required
- Default configurations are vulnerable
- Near 100% reliability in exploitation

**Impact:**
- Full remote code execution on the server
- Execution occurs under NodeJS runtime privileges
- Both Windows and Linux environments affected
- Applications without explicitly defined server functions may still be vulnerable

### Attack Surface Indicators

Applications are potentially vulnerable if they:
1. Use React 19.x with Server Components enabled
2. Import any `react-server-dom-*` packages
3. Use frameworks built on RSC (Next.js App Router, etc.)
4. Have any server-side React component rendering

---

## Detection Methods

### Package Audit Commands

```bash
# NPM - Check for vulnerable packages
npm ls react-server-dom-webpack react-server-dom-turbopack react-server-dom-parcel

# NPM - Security audit
npm audit

# Yarn
yarn why react-server-dom-webpack
yarn audit

# PNPM
pnpm list react-server-dom-webpack
pnpm audit
```

### Version Check in package.json

Look for these patterns indicating potential vulnerability:

```json
{
  "dependencies": {
    "react": "^19.0.0",
    "react-dom": "^19.0.0",
    "next": "^15.0.0"
  }
}
```

**Note:** The caret (^) allows minor/patch updates, so actual installed version may differ. Always check lock files:

```bash
# Check actual installed versions
grep -E "react-server-dom" package-lock.json
grep -E "react-server-dom" yarn.lock
```

### Log Indicators of Exploitation

Monitor for:
- Unusual POST requests to RSC endpoints
- Unexpected child process spawning from Node.js
- Base64-encoded command execution in logs
- Connections to unknown external IPs from web server processes
- Creation of files in /tmp or unusual directories
- Modifications to systemd, cron, rc.local, or authorized_keys

---

## Remediation Steps

### Immediate Actions

1. **Identify Exposure**
   ```bash
   # List all React-related packages
   npm ls | grep -E "(react|next)"
   
   # Check specific RSC packages
   npm ls react-server-dom-webpack react-server-dom-turbopack react-server-dom-parcel 2>/dev/null
   ```

2. **Update React Packages**
   ```bash
   # Update to patched versions
   npm install react@latest react-dom@latest
   npm install react-server-dom-webpack@19.2.3
   npm install react-server-dom-turbopack@19.2.3
   npm install react-server-dom-parcel@19.2.3
   ```

3. **Update Next.js**
   ```bash
   # For 14.x users
   npm install next@14.2.35
   
   # For 15.x/16.x users
   npm install next@latest
   ```

4. **Verify Updates**
   ```bash
   npm audit
   npm ls react-server-dom-webpack
   ```

### Additional Hardening

1. Implement WAF rules to filter malicious RSC payloads
2. Enable detailed logging for RSC endpoints
3. Restrict outbound network access from application servers
4. Monitor for indicators of compromise listed above

---

## Related Vulnerabilities

These were discovered during scrutiny following CVE-2025-55182:

| CVE | Severity | Description | Patched In |
|-----|----------|-------------|------------|
| CVE-2025-55183 | Medium (5.3) | Source Code Exposure | 19.0.3, 19.1.4, 19.2.3 |
| CVE-2025-55184 | High (7.5) | Denial of Service | 19.0.3, 19.1.4, 19.2.3 |
| CVE-2025-67779 | - | DoS (incomplete CVE-2025-55184 fix) | 19.0.3, 19.1.4, 19.2.3 |
| CVE-2025-66478 | Rejected | Duplicate of CVE-2025-55182 | N/A |

**Recommendation:** Update to at least 19.0.3, 19.1.4, or 19.2.3 to address all known vulnerabilities.

---

## Observed Threat Activity

### Attribution

Multiple threat actors have been observed exploiting this vulnerability:
- Opportunistic cybercriminals (cryptominers)
- CL-STA-1015 (Initial Access Broker with suspected PRC MSS ties)
- North Korean state-sponsored actors (per Sysdig research)
- Red team assessments

### Post-Exploitation TTPs

**Initial Access:**
- Automated scanning for vulnerable endpoints
- Single HTTP POST request exploitation

**Execution:**
- Base64-encoded commands
- Reverse shells (Bash, PowerShell)
- Cobalt Strike beacons

**Persistence:**
- New user creation
- SSH authorized_keys modification
- Systemd service installation
- Cron job creation
- rc.local modifications
- RMM tools (MeshAgent)

**Malware Deployed:**
- SNOWLIGHT downloader
- VShell Trojans
- MINOCAT tunneler
- HISONIC backdoor
- COMPOOD backdoor
- EtherRAT
- XMRIG cryptocurrency miners

---

## Assessment Checklist

Use this checklist when reviewing applications:

### Discovery Phase
- [ ] Application uses React 19.x
- [ ] Application uses Server Components or App Router
- [ ] Identified react-server-dom-* packages in dependencies
- [ ] Checked transitive dependencies for RSC packages
- [ ] Verified framework versions (Next.js, React Router, etc.)

### Version Verification
- [ ] Checked package.json for version declarations
- [ ] Verified actual installed versions in lock files
- [ ] Ran `npm audit` or equivalent
- [ ] Documented all vulnerable packages found

### Risk Assessment
- [ ] Application is internet-facing
- [ ] Application processes user-supplied data server-side
- [ ] Identified all RSC endpoints
- [ ] Evaluated WAF coverage for RSC endpoints

### Remediation Tracking
- [ ] Created upgrade plan with dependencies
- [ ] Tested upgrades in non-production environment
- [ ] Deployed patches to production
- [ ] Verified patches with post-deployment audit
- [ ] Implemented additional monitoring/detection

---

## References

- [React Security Advisory](https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components)
- [React Follow-up Advisory (DoS/Source Exposure)](https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components)
- [NVD Entry](https://nvd.nist.gov/vuln/detail/CVE-2025-55182)
- [CISA KEV Entry](https://www.cisa.gov/news-events/alerts/2025/12/05/cisa-adds-one-known-exploited-vulnerability-catalog)
- [Microsoft Security Blog](https://www.microsoft.com/en-us/security/blog/2025/12/15/defending-against-the-cve-2025-55182-react2shell-vulnerability-in-react-server-components/)
- [Unit 42 Analysis](https://unit42.paloaltonetworks.com/cve-2025-55182-react-and-cve-2025-66478-next/)
- [Google Threat Intelligence](https://cloud.google.com/blog/topics/threat-intelligence/threat-actors-exploit-react2shell-cve-2025-55182)
- [OffSec Technical Analysis](https://www.offsec.com/blog/cve-2025-55182/)

---

*Document Version: 1.0*  
*Last Updated: January 2026*  
*For use in application security reviews*