wulf-pulse/dev/CVE-2025-55182-React2Shell-Review.md

CVE-2025-55182: React Server Components RCE (React2Shell)

Executive Summary

CVE ID: CVE-2025-55182
Also Known As: React2Shell
CVSS Score: 10.0 (Critical)
Disclosure Date: December 3, 2025
CISA KEV Added: December 5, 2025
Active Exploitation: Confirmed

A pre-authentication remote code execution vulnerability exists in React Server Components that allows unauthenticated attackers to execute arbitrary code on the server via insecure deserialization of malicious HTTP requests.

---

Affected Versions

React Server Component Packages (Direct)

Package	Vulnerable Versions	Patched Versions
react-server-dom-parcel	19.0.0, 19.1.0, 19.1.1, 19.2.0	19.0.1, 19.1.2, 19.2.1+
react-server-dom-turbopack	19.0.0, 19.1.0, 19.1.1, 19.2.0	19.0.1, 19.1.2, 19.2.1+
react-server-dom-webpack	19.0.0, 19.1.0, 19.1.1, 19.2.0	19.0.1, 19.1.2, 19.2.1+

Frameworks & Bundlers (Indirect)

Framework/Bundler	Vulnerable Versions	Notes
Next.js	14.3.0-canary, 15.x, 16.x (App Router)	Upgrade to 14.2.35+ or latest stable
React Router	RSC mode versions	Upgrade react-server-dom-* packages
Waku	Versions using RSC	Check dependencies
@parcel/rsc	RSC implementations	Check dependencies
@vite/rsc-plugin	RSC implementations	Check dependencies
rwsdk (RedwoodSDK)	RSC implementations	Check dependencies

---

Technical Details

Vulnerability Mechanism

The vulnerability resides in the RSC Flight protocol implementation. The server processes RSC payloads unsafely, allowing attacker-controlled data to influence server-side execution logic through deserialization.

Attack Vector:

• Single malicious HTTP POST request
• No authentication required
• No user interaction required
• Default configurations are vulnerable
• Near 100% reliability in exploitation

Impact:

• Full remote code execution on the server
• Execution occurs under NodeJS runtime privileges
• Both Windows and Linux environments affected
• Applications without explicitly defined server functions may still be vulnerable

Attack Surface Indicators

Applications are potentially vulnerable if they:

1. Use React 19.x with Server Components enabled
2. Import any react-server-dom-* packages
3. Use frameworks built on RSC (Next.js App Router, etc.)
4. Have any server-side React component rendering

---

Detection Methods

Package Audit Commands

# NPM - Check for vulnerable packages
npm ls react-server-dom-webpack react-server-dom-turbopack react-server-dom-parcel

# NPM - Security audit
npm audit

# Yarn
yarn why react-server-dom-webpack
yarn audit

# PNPM
pnpm list react-server-dom-webpack
pnpm audit

Version Check in package.json

Look for these patterns indicating potential vulnerability:

{
  "dependencies": {
    "react": "^19.0.0",
    "react-dom": "^19.0.0",
    "next": "^15.0.0"
  }
}

Note: The caret (^) allows minor/patch updates, so actual installed version may differ. Always check lock files:

# Check actual installed versions
grep -E "react-server-dom" package-lock.json
grep -E "react-server-dom" yarn.lock

Log Indicators of Exploitation

Monitor for:

• Unusual POST requests to RSC endpoints
• Unexpected child process spawning from Node.js
• Base64-encoded command execution in logs
• Connections to unknown external IPs from web server processes
• Creation of files in /tmp or unusual directories
• Modifications to systemd, cron, rc.local, or authorized_keys

---

Remediation Steps

Immediate Actions

1. Identify Exposure

   # List all React-related packages
   npm ls | grep -E "(react|next)"
   
   # Check specific RSC packages
   npm ls react-server-dom-webpack react-server-dom-turbopack react-server-dom-parcel 2>/dev/null
   

2. Update React Packages

   # Update to patched versions
   npm install react@latest react-dom@latest
   npm install react-server-dom-webpack@19.2.3
   npm install react-server-dom-turbopack@19.2.3
   npm install react-server-dom-parcel@19.2.3
   

3. Update Next.js

   # For 14.x users
   npm install next@14.2.35
   
   # For 15.x/16.x users
   npm install next@latest
   

4. Verify Updates

   npm audit
   npm ls react-server-dom-webpack
   

Additional Hardening

1. Implement WAF rules to filter malicious RSC payloads
2. Enable detailed logging for RSC endpoints
3. Restrict outbound network access from application servers
4. Monitor for indicators of compromise listed above

---

Related Vulnerabilities

These were discovered during scrutiny following CVE-2025-55182:

CVE	Severity	Description	Patched In
CVE-2025-55183	Medium (5.3)	Source Code Exposure	19.0.3, 19.1.4, 19.2.3
CVE-2025-55184	High (7.5)	Denial of Service	19.0.3, 19.1.4, 19.2.3
CVE-2025-67779	-	DoS (incomplete CVE-2025-55184 fix)	19.0.3, 19.1.4, 19.2.3
CVE-2025-66478	Rejected	Duplicate of CVE-2025-55182	N/A

Recommendation: Update to at least 19.0.3, 19.1.4, or 19.2.3 to address all known vulnerabilities.

---

Observed Threat Activity

Attribution

Multiple threat actors have been observed exploiting this vulnerability:

• Opportunistic cybercriminals (cryptominers)
• CL-STA-1015 (Initial Access Broker with suspected PRC MSS ties)
• North Korean state-sponsored actors (per Sysdig research)
• Red team assessments

Post-Exploitation TTPs

Initial Access:

• Automated scanning for vulnerable endpoints
• Single HTTP POST request exploitation

Execution:

• Base64-encoded commands
• Reverse shells (Bash, PowerShell)
• Cobalt Strike beacons

Persistence:

• New user creation
• SSH authorized_keys modification
• Systemd service installation
• Cron job creation
• rc.local modifications
• RMM tools (MeshAgent)

Malware Deployed:

• SNOWLIGHT downloader
• VShell Trojans
• MINOCAT tunneler
• HISONIC backdoor
• COMPOOD backdoor
• EtherRAT
• XMRIG cryptocurrency miners

---

Assessment Checklist

Use this checklist when reviewing applications:

Discovery Phase

• Application uses React 19.x
• Application uses Server Components or App Router
• Identified react-server-dom-* packages in dependencies
• Checked transitive dependencies for RSC packages
• Verified framework versions (Next.js, React Router, etc.)

Version Verification

• Checked package.json for version declarations
• Verified actual installed versions in lock files
• Ran npm audit or equivalent
• Documented all vulnerable packages found

Risk Assessment

• Application is internet-facing
• Application processes user-supplied data server-side
• Identified all RSC endpoints
• Evaluated WAF coverage for RSC endpoints

Remediation Tracking

• Created upgrade plan with dependencies
• Tested upgrades in non-production environment
• Deployed patches to production
• Verified patches with post-deployment audit
• Implemented additional monitoring/detection

---

References

• React Security Advisory
• React Follow-up Advisory (DoS/Source Exposure)
• NVD Entry
• CISA KEV Entry
• Microsoft Security Blog
• Unit 42 Analysis
• Google Threat Intelligence
• OffSec Technical Analysis

---

Document Version: 1.0
Last Updated: January 2026
For use in application security reviews