feat: add authentication, user management, and admin features
Added comprehensive authentication and authorization system: Authentication System: - Better Auth integration with session management - Login/logout pages and API routes - Middleware for route protection - Auth utilities and client libraries User Management: - User list, detail, and invite pages - User API endpoints (CRUD operations) - Session management for users - Profile settings page Role-Based Access Control: - Role management pages (list, create, edit) - Permission system with granular controls - Role assignment to users - Role API endpoints Admin Features: - Audit log page for tracking system events - Admin settings page - Audit service for logging user actions Additional Features: - Quotes management pages and components - SalesBldr API integration - Email service for notifications Configuration & Documentation: - Updated docker-compose.yml - MCP server configuration (mcp.json) - CVE-2025-55182 security review documentation - Standards guide and PRD documents - Re-enabling authentication documentation Database Migrations: - 012: Auth tables (users, sessions, accounts, verifications) - 013: Role tables (roles, permissions, role_permissions, user_roles) - 014: Admin settings table UI Updates: - Updated dashboard layout - Enhanced app layout with auth integration
This commit is contained in:
root
parent
d8e6931b85
commit
9f912aed24
68 changed files with 7651 additions and 3 deletions
270
dev/CVE-2025-55182-React2Shell-Review.md
Normal file
270
dev/CVE-2025-55182-React2Shell-Review.md
Normal file
|
|
@ -0,0 +1,270 @@
|
|||
# CVE-2025-55182: React Server Components RCE (React2Shell)
|
||||
|
||||
## Executive Summary
|
||||
|
||||
**CVE ID:** CVE-2025-55182
|
||||
**Also Known As:** React2Shell
|
||||
**CVSS Score:** 10.0 (Critical)
|
||||
**Disclosure Date:** December 3, 2025
|
||||
**CISA KEV Added:** December 5, 2025
|
||||
**Active Exploitation:** Confirmed
|
||||
|
||||
A pre-authentication remote code execution vulnerability exists in React Server Components that allows unauthenticated attackers to execute arbitrary code on the server via insecure deserialization of malicious HTTP requests.
|
||||
|
||||
---
|
||||
|
||||
## Affected Versions
|
||||
|
||||
### React Server Component Packages (Direct)
|
||||
|
||||
| Package | Vulnerable Versions | Patched Versions |
|
||||
|---------|---------------------|------------------|
|
||||
| react-server-dom-parcel | 19.0.0, 19.1.0, 19.1.1, 19.2.0 | 19.0.1, 19.1.2, 19.2.1+ |
|
||||
| react-server-dom-turbopack | 19.0.0, 19.1.0, 19.1.1, 19.2.0 | 19.0.1, 19.1.2, 19.2.1+ |
|
||||
| react-server-dom-webpack | 19.0.0, 19.1.0, 19.1.1, 19.2.0 | 19.0.1, 19.1.2, 19.2.1+ |
|
||||
|
||||
### Frameworks & Bundlers (Indirect)
|
||||
|
||||
| Framework/Bundler | Vulnerable Versions | Notes |
|
||||
|-------------------|---------------------|-------|
|
||||
| Next.js | 14.3.0-canary, 15.x, 16.x (App Router) | Upgrade to 14.2.35+ or latest stable |
|
||||
| React Router | RSC mode versions | Upgrade react-server-dom-* packages |
|
||||
| Waku | Versions using RSC | Check dependencies |
|
||||
| @parcel/rsc | RSC implementations | Check dependencies |
|
||||
| @vite/rsc-plugin | RSC implementations | Check dependencies |
|
||||
| rwsdk (RedwoodSDK) | RSC implementations | Check dependencies |
|
||||
|
||||
---
|
||||
|
||||
## Technical Details
|
||||
|
||||
### Vulnerability Mechanism
|
||||
|
||||
The vulnerability resides in the RSC Flight protocol implementation. The server processes RSC payloads unsafely, allowing attacker-controlled data to influence server-side execution logic through deserialization.
|
||||
|
||||
**Attack Vector:**
|
||||
- Single malicious HTTP POST request
|
||||
- No authentication required
|
||||
- No user interaction required
|
||||
- Default configurations are vulnerable
|
||||
- Near 100% reliability in exploitation
|
||||
|
||||
**Impact:**
|
||||
- Full remote code execution on the server
|
||||
- Execution occurs under NodeJS runtime privileges
|
||||
- Both Windows and Linux environments affected
|
||||
- Applications without explicitly defined server functions may still be vulnerable
|
||||
|
||||
### Attack Surface Indicators
|
||||
|
||||
Applications are potentially vulnerable if they:
|
||||
1. Use React 19.x with Server Components enabled
|
||||
2. Import any `react-server-dom-*` packages
|
||||
3. Use frameworks built on RSC (Next.js App Router, etc.)
|
||||
4. Have any server-side React component rendering
|
||||
|
||||
---
|
||||
|
||||
## Detection Methods
|
||||
|
||||
### Package Audit Commands
|
||||
|
||||
```bash
|
||||
# NPM - Check for vulnerable packages
|
||||
npm ls react-server-dom-webpack react-server-dom-turbopack react-server-dom-parcel
|
||||
|
||||
# NPM - Security audit
|
||||
npm audit
|
||||
|
||||
# Yarn
|
||||
yarn why react-server-dom-webpack
|
||||
yarn audit
|
||||
|
||||
# PNPM
|
||||
pnpm list react-server-dom-webpack
|
||||
pnpm audit
|
||||
```
|
||||
|
||||
### Version Check in package.json
|
||||
|
||||
Look for these patterns indicating potential vulnerability:
|
||||
|
||||
```json
|
||||
{
|
||||
"dependencies": {
|
||||
"react": "^19.0.0",
|
||||
"react-dom": "^19.0.0",
|
||||
"next": "^15.0.0"
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
**Note:** The caret (^) allows minor/patch updates, so actual installed version may differ. Always check lock files:
|
||||
|
||||
```bash
|
||||
# Check actual installed versions
|
||||
grep -E "react-server-dom" package-lock.json
|
||||
grep -E "react-server-dom" yarn.lock
|
||||
```
|
||||
|
||||
### Log Indicators of Exploitation
|
||||
|
||||
Monitor for:
|
||||
- Unusual POST requests to RSC endpoints
|
||||
- Unexpected child process spawning from Node.js
|
||||
- Base64-encoded command execution in logs
|
||||
- Connections to unknown external IPs from web server processes
|
||||
- Creation of files in /tmp or unusual directories
|
||||
- Modifications to systemd, cron, rc.local, or authorized_keys
|
||||
|
||||
---
|
||||
|
||||
## Remediation Steps
|
||||
|
||||
### Immediate Actions
|
||||
|
||||
1. **Identify Exposure**
|
||||
```bash
|
||||
# List all React-related packages
|
||||
npm ls | grep -E "(react|next)"
|
||||
|
||||
# Check specific RSC packages
|
||||
npm ls react-server-dom-webpack react-server-dom-turbopack react-server-dom-parcel 2>/dev/null
|
||||
```
|
||||
|
||||
2. **Update React Packages**
|
||||
```bash
|
||||
# Update to patched versions
|
||||
npm install react@latest react-dom@latest
|
||||
npm install react-server-dom-webpack@19.2.3
|
||||
npm install react-server-dom-turbopack@19.2.3
|
||||
npm install react-server-dom-parcel@19.2.3
|
||||
```
|
||||
|
||||
3. **Update Next.js**
|
||||
```bash
|
||||
# For 14.x users
|
||||
npm install next@14.2.35
|
||||
|
||||
# For 15.x/16.x users
|
||||
npm install next@latest
|
||||
```
|
||||
|
||||
4. **Verify Updates**
|
||||
```bash
|
||||
npm audit
|
||||
npm ls react-server-dom-webpack
|
||||
```
|
||||
|
||||
### Additional Hardening
|
||||
|
||||
1. Implement WAF rules to filter malicious RSC payloads
|
||||
2. Enable detailed logging for RSC endpoints
|
||||
3. Restrict outbound network access from application servers
|
||||
4. Monitor for indicators of compromise listed above
|
||||
|
||||
---
|
||||
|
||||
## Related Vulnerabilities
|
||||
|
||||
These were discovered during scrutiny following CVE-2025-55182:
|
||||
|
||||
| CVE | Severity | Description | Patched In |
|
||||
|-----|----------|-------------|------------|
|
||||
| CVE-2025-55183 | Medium (5.3) | Source Code Exposure | 19.0.3, 19.1.4, 19.2.3 |
|
||||
| CVE-2025-55184 | High (7.5) | Denial of Service | 19.0.3, 19.1.4, 19.2.3 |
|
||||
| CVE-2025-67779 | - | DoS (incomplete CVE-2025-55184 fix) | 19.0.3, 19.1.4, 19.2.3 |
|
||||
| CVE-2025-66478 | Rejected | Duplicate of CVE-2025-55182 | N/A |
|
||||
|
||||
**Recommendation:** Update to at least 19.0.3, 19.1.4, or 19.2.3 to address all known vulnerabilities.
|
||||
|
||||
---
|
||||
|
||||
## Observed Threat Activity
|
||||
|
||||
### Attribution
|
||||
|
||||
Multiple threat actors have been observed exploiting this vulnerability:
|
||||
- Opportunistic cybercriminals (cryptominers)
|
||||
- CL-STA-1015 (Initial Access Broker with suspected PRC MSS ties)
|
||||
- North Korean state-sponsored actors (per Sysdig research)
|
||||
- Red team assessments
|
||||
|
||||
### Post-Exploitation TTPs
|
||||
|
||||
**Initial Access:**
|
||||
- Automated scanning for vulnerable endpoints
|
||||
- Single HTTP POST request exploitation
|
||||
|
||||
**Execution:**
|
||||
- Base64-encoded commands
|
||||
- Reverse shells (Bash, PowerShell)
|
||||
- Cobalt Strike beacons
|
||||
|
||||
**Persistence:**
|
||||
- New user creation
|
||||
- SSH authorized_keys modification
|
||||
- Systemd service installation
|
||||
- Cron job creation
|
||||
- rc.local modifications
|
||||
- RMM tools (MeshAgent)
|
||||
|
||||
**Malware Deployed:**
|
||||
- SNOWLIGHT downloader
|
||||
- VShell Trojans
|
||||
- MINOCAT tunneler
|
||||
- HISONIC backdoor
|
||||
- COMPOOD backdoor
|
||||
- EtherRAT
|
||||
- XMRIG cryptocurrency miners
|
||||
|
||||
---
|
||||
|
||||
## Assessment Checklist
|
||||
|
||||
Use this checklist when reviewing applications:
|
||||
|
||||
### Discovery Phase
|
||||
- [ ] Application uses React 19.x
|
||||
- [ ] Application uses Server Components or App Router
|
||||
- [ ] Identified react-server-dom-* packages in dependencies
|
||||
- [ ] Checked transitive dependencies for RSC packages
|
||||
- [ ] Verified framework versions (Next.js, React Router, etc.)
|
||||
|
||||
### Version Verification
|
||||
- [ ] Checked package.json for version declarations
|
||||
- [ ] Verified actual installed versions in lock files
|
||||
- [ ] Ran `npm audit` or equivalent
|
||||
- [ ] Documented all vulnerable packages found
|
||||
|
||||
### Risk Assessment
|
||||
- [ ] Application is internet-facing
|
||||
- [ ] Application processes user-supplied data server-side
|
||||
- [ ] Identified all RSC endpoints
|
||||
- [ ] Evaluated WAF coverage for RSC endpoints
|
||||
|
||||
### Remediation Tracking
|
||||
- [ ] Created upgrade plan with dependencies
|
||||
- [ ] Tested upgrades in non-production environment
|
||||
- [ ] Deployed patches to production
|
||||
- [ ] Verified patches with post-deployment audit
|
||||
- [ ] Implemented additional monitoring/detection
|
||||
|
||||
---
|
||||
|
||||
## References
|
||||
|
||||
- [React Security Advisory](https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components)
|
||||
- [React Follow-up Advisory (DoS/Source Exposure)](https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components)
|
||||
- [NVD Entry](https://nvd.nist.gov/vuln/detail/CVE-2025-55182)
|
||||
- [CISA KEV Entry](https://www.cisa.gov/news-events/alerts/2025/12/05/cisa-adds-one-known-exploited-vulnerability-catalog)
|
||||
- [Microsoft Security Blog](https://www.microsoft.com/en-us/security/blog/2025/12/15/defending-against-the-cve-2025-55182-react2shell-vulnerability-in-react-server-components/)
|
||||
- [Unit 42 Analysis](https://unit42.paloaltonetworks.com/cve-2025-55182-react-and-cve-2025-66478-next/)
|
||||
- [Google Threat Intelligence](https://cloud.google.com/blog/topics/threat-intelligence/threat-actors-exploit-react2shell-cve-2025-55182)
|
||||
- [OffSec Technical Analysis](https://www.offsec.com/blog/cve-2025-55182/)
|
||||
|
||||
---
|
||||
|
||||
*Document Version: 1.0*
|
||||
*Last Updated: January 2026*
|
||||
*For use in application security reviews*
|
||||
BIN
dev/StandardsGuide.pdf
Normal file
BIN
dev/StandardsGuide.pdf
Normal file
Binary file not shown.
Loading…
Add table
Add a link
Reference in a new issue