TL; DR
React2Shell (CVE-2025-55182) tsim ib qho tseem ceeb Kev pheej hmoo ntawm RCE thoob plaws Cov Cheebtsam Server React (RSC) thiab cov qauv uas muab lawv tso rau hauv, suav nrog Tom ntej no.jsVim tias qhov tsis muaj zog nyob sab hauv RSC txheej serialization thiab deserialization, cov neeg tawm tsam tuaj yeem xa ib qho kev thov HTTP thiab ua rau muaj teeb meem kev ua tiav cov lej nyob deb uas tsis tau lees paub, txawm tias thaum cov pab pawg khiav cov qauv teeb tsa ua ntej. Tom ntej no.js cov ntawv thov ntsib kev raug mob siab tshaj plaws vim lawv lees txais thiab ua tiav Kev Sib Tw Dav Hlau payloads hla HTTP los ntawm lub neej ntawd.
Qhov tsis zoo no cuam tshuam rau ntau hom versions ntawm Cov pob khoom ntawm React server, thiab cov neeg tawm tsam tsis xav tau kev cai thov logic los siv nws. Cov kws tshawb fawb kev ruaj ntseg qhia txog kev ntseeg tau ze li ntawm 100%, thiab kev luam theej thaum ntxov qhia tias ntau qhov chaw huab khiav tsis muaj zog Tom ntej no.js cov piv txwv. Cov pab pawg yuav tsum tau kho tam sim ntawd thiab lees paub lawv lub ecosystem tag nrho kom txo qhov React2Shell (CVE-2025-55182) Kev pheej hmoo RCE.
Ib qho teeb meem loj heev uas tau tshaj tawm los ntawm Meta qhov kev pab cuam kab laum rau lub Kaum Ib Hlis 29th tau ua rau muaj kev teb sai sai thoob plaws JavaScript ecosystem.
Tsim tawm CVE-2025-55182, qhia tawm rau lub Kaum Ob Hlis 3 tam sim no hu ua React2Shell yog qhov tsis muaj zog tshaj plaws uas cuam tshuam rau React Server Cheebtsam nrog rau cov qauv uas koom ua ke nrog lawv. Thaum xub thawj, tus cim qhia qhov tsis muaj zog Next.js (CVE-2025-66478) tau muab cais, tab sis NVD tom qab ntawd tau muab nws sib sau ua ke rau hauv React CVE thawj zaug ua ib qho ntawv nkag.
Qhov teeb meem tseem ceeb yog tib yam, kev tswj hwm tsis muaj kev nyab xeeb ntawm cov payloads RSC uas tuaj yeem raug cuam tshuam los ntawm HTTP thov. Qhov no qhib lub qhov rooj rau tus neeg ua phem xa cov lus thov HTTP uas ua rau JavaScript khiav ntawm lub server tom qab raug deserialized los ntawm React.
CVE-2025-55182 Txheej Txheem Cej Luam
Cov Cheebtsam ntawm React Server tau sib xyaw ua ke nrog cov qauv niaj hnub, thiab feem ntau yog qhib los ntawm lub neej ntawd. Vim li no, cov ntawv thov yuav raug rau React2Shell (CVE-2025-55182) txawm tias lawv yeej tsis tau txhais meej meej txog qhov kawg ntawm Server Function. Kev siv RSC tseem muaj, thiab qhov ntawd ib leeg xwb txaus los qhib cov txoj kev code uas tsis muaj zog thiab tsim kom muaj qhov tseem ceeb Kev pheej hmoo ntawm RCE.
Qhov tsis zoo yog los ntawm txoj kev uas lub React Flight protocol ua qee yam kev them nyiaj uas muaj qauv. Cov qauv qub dua tau sim taug kev cov kev uas tau muab rau hauv qhov them nyiaj yam tsis tau txheeb xyuas tias cov qauv no siv tau lossis xav tau. Tus neeg tawm tsam tuaj yeem tswj cov txheej txheem no thiab thaum kawg mus txog kev ua tiav ntawm cov lej ntawm lub server. Tsis muaj kev lees paub, tsis muaj kev teeb tsa tshwj xeeb, thiab tsis tas yuav muaj kev xav tshwj xeeb rau app. Vim tias qhov teeb meem muaj nyob rau hauv cov kev teeb tsa tawm ntawm lub thawv, standard kev xa tawm raug nthuav tawm yam tsis xav tau tej yam xwm txheej txawv txawv.
Kev siv tsis raug cai tshwm sim thaum cov neeg tawm tsam xa cov lus thov HTTP POST phem uas siv tsis raug "vm.runInThisContext” txoj hauv kev los ntawm Server Actions. Txawm hais tias React tsis qhia ncaj qha rau qhov kawg uas tsis muaj zog, Next.js ua, tsim kom muaj kev tawm tsam deb tiag tiag.
Next.js txais cov Flight payloads los ntawm txhua qhov kev thov, ua tiav lawv yam tsis muaj kev lees paub zoo, thiab xa mus rau React's deserializer. Lub kaw lus kho cov inputs sab nraud no raws li kev ntseeg siab, ua rau cov neeg tawm tsam ua tiav kev ua tiav cov lej nyob deb los ntawm cov chaw xaus uas pej xeem nkag tau nrog rau tag nrho cov cai ntawm Node.js cov txheej txheem ntawm lub server uas koj xav tau.
Qhov hnyav nce ntxiv ntau heev vim tias cov kev teeb tsa tsis raws cai tseem muaj kev phom sij rau React2Shell (CVE-2025-55182) thiab qhov tshwm sim Kev pheej hmoo ntawm RCE. A standard Daim ntawv thov Next.js uas koj tsim nrog create-next-app qhia nws tus kheej yam tsis tas yuav muaj kev hloov pauv code lossis kev teeb tsa. Cov kws tshawb fawb txog kev ruaj ntseg lees paub yuav luag 100% kev ntseeg siab ntawm kev siv thiab tshaj tawm tias 39% ntawm cov huab ib puag ncig khiav cov xwm txheej tsis muaj zog, thaum 44% ntawm txhua qhov chaw khiav cov ntawv thov Next.js uas raug rau pej xeem cuam tshuam los ntawm React2Shell.
Nkag Siab Txog Kev Raug React2Shell
Cov versions uas tsis muaj zog no muaj ntau hom kev tso tawm:
| tivthaiv | Cov Qauv Cuam Tshuam |
|---|---|
| react-server-dom-webpack | 19.0, 19.1.0, 19.1.1, 19.2.0 |
| react-server-dom-parcel | 19.0, 19.1.0, 19.1.1, 19.2.0 |
| react-server-dom-turbopack | 19.0, 19.1.0, 19.1.1, 19.2.0 |
Vim tias ntau lub frameworks muab kev txhawb nqa RSC tso rau hauv lub hauv paus, cov ntawv thov feem ntau tau txais cov lej tsis muaj zog yam tsis paub txog nws. Txhua lub framework lossis bundler uas xa cov pob khoom no tuaj yeem ua rau daim ntawv thov raug React2Shell (CVE-2025-55182) thiab nws qhov kev pheej hmoo RCE. Qhov ntawd suav nrog:
- Next.js (App router)
- React Router RSC saib ua ntej
- Vite RSC plugin
- Parcel RSC plugin
- Redwood SDK
- Waku
- Expo
Next.js raug cuam tshuam tshwj xeeb vim nws siv RSC-related endpoints hla HTTP los ntawm lub neej ntawd. Cov versions pib nrog 14.3.0 canary tsim, nrog rau feem ntau 15.x thiab thaum ntxov 16.x cov kev tso tawm, muaj cov kev siv tsis muaj zog. Txhua tus neeg khiav canary 14.3.0-canary.77 los yog tom qab ntawd yuav tsum rov qab mus rau ruaj khov 14.x ceg kom txog thaum muaj daim ntawv canary patched luam tawm.
Kho kom raug Next.js versions suav nrog:
| tivthaiv | Cov Qauv Kho Dua Tshiab |
|---|---|
| Tom ntej no.js | 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7 |
Cov PoC rau pej xeem thiab kev tshawb pom txhim khu kev qha
Tom qab qhov kev tshaj tawm qhov tsis muaj zog, ntau cov pov thawj ntawm cov tswv yim pib ncig. Ntau ntawm lawv tsis raug lossis raws li cov kev xav tsis zoo. Tus sau thawj qhov tsis muaj zog, Lachlan Davidson, tau lees paub rau pej xeem rau hnub tim react2shell tias GitHub PoCs uas ncig tsis sib xws nrog qhov kev siv tsis raug uas tau sib koom nrog React/Next.js cov neeg saib xyuas thiab tau muab nws tus kheej PoC.
Qhov teeb meem loj nrog kev sim ua pej xeem thaum ntxov yog lawv txoj kev tsis lees paub tias kev siv tsis raug cai ua tiav tawm tsam standard Kev xa tawm Next.js yam tsis tas yuav tsum muaj cov logic thov tshwj xeeb lossis cov haujlwm sab server.
Cov kws tshawb fawb txog kev ruaj ntseg los ntawm ntau lub koom haum tau hais tias kev nrhiav pom qhov tsis muaj zog yuav tsum tau ntau dua li tsuas yog txheeb xyuas seb RSC puas muaj. Assetnote pab neeg tau tshaj tawm ib qho txoj kev nrhiav kom tau zoo thiab ib tug scanner muaj peev xwm lees paub qhov teeb meem yam tsis siv cov laj thawj siv tsis raug. Metasploit yuav sai sai no muaj ib qho kev siv tsis tau rau qhov kev tsis txaus siab no thiab.
Txoj kev tshawb nrhiav siv li cas React Server tuav cov khoom siv cov khoom siv siv cov kab ke hauv qab ReactFlightClientConfigBundlerWebpack.js/requireModule() muaj nuj nqi. Thaum cov qauv tsis muaj zog ua cov txheej txheem them nyiaj ntau yam uas sim hla cov kev taug kev tsis muaj nyob, lawv ua rau muaj kev teb yuam kev uas kwv yees tau. Ib qho kev thov kuaj mob xa cov qauv siv xws li `$1:ib:ib` ua ke nrog ib yam khoom khoob. Cov kev siv tsis muaj zog sim daws qhov no ua kev nkag mus rau cov khoom vaj khoom tsev ntawm tus nqi tsis tau txhais, ua rau muaj kev zam. Lub server xa rov qab 500 qhov xwm txheej nrog tus qauv zom zaub mov yuam kev sib txawv hauv lub cev teb.
export function requireModule<T>(metadata: ClientReference<T>): T { let moduleExports = __webpack_require__(metadata[ID]); if (isAsyncImport(metadata)) { if (typeof moduleExports.then !== 'function') { // This wasn't a promise after all. } else if (moduleExports.status === 'fulfilled') { // This Promise should've been instrumented by preloadModule. moduleExports = moduleExports.value; } else { throw moduleExports.reason; } } if (metadata[NAME] === '*') { // This is a placeholder value that represents that the caller imported this // as a CommonJS module as is. return moduleExports; } if (metadata[NAME] === '') { // This is a placeholder value that represents that the caller accessed the // default property of this if it was an ESM interop module. return moduleExports.__esModule ? moduleExports.default : moduleExports; } return moduleExports[metadata[NAME]]; } Cov Kev Ua Tam Sim No Rau Cov Koom Haum Uas Ntsib React2Shell (CVE-2025-55182) thiab Kev Pheej Hmoo RCE
Ua ib qho kev luam theej tag nrho ntawm koj cov codebase thiab cov ntawv thov xa tawm Txhawm rau nrhiav cov pob khoom uas tsis muaj zog. Ua tib zoo saib xyuas cov kev vam khom ntawm pob khoom React server, kev siv RSC theem Framework (Next.js, Waku, Redwood, thiab lwm yam), cov ntawv thov uas tsim los ntawm 'create-next-app' lossis cov cuab yeej scaffolding zoo sib xws thiab cov ntawv thov containerized uas yuav muaj cov duab qub qub.
Kev Tshawb Fawb Txog Kev Tsim Kho Software (SCA) cov cuab yeej zoo li Xygeni's SCA tuaj yeem nrhiav tau qhov cuam tshuam ntawm kev vam khom thoob plaws hauv koj cov software.
Kho tam sim ntawd:
Hloov kho rau cov version uas tau kho dua tshiab xws li React (19.0.1, 19.1.2, 19.2.1), Next.js (15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7) thiab txhua lub framework packages uas muaj RSC. Cov kev hloov kho no qhia txog kev lees paub nruj rau RSC payload handling thiab tiv thaiv kev tsis muaj kev nyab xeeb ntawm cov khoom siv uas ua rau muaj kev siv tsis raug.
Cov cuab yeej kho kom rov zoo li qub, xws li Xygeni qhov kev kho kom rov zoo tsis siv neeg, tuaj yeem ua kom cov txheej txheem nrawm dua thoob plaws cov codebases loj.
Siv Kev Tiv Thaiv WAF Ib Ntus:
Thaum cov patches kis mus thoob plaws koj qhov kev xa tawm pipeline, qhib cov cai ntawm Web Application Firewall kom tiv thaiv tau tam sim ntawd. Cov chaw muab kev pabcuam huab loj tau tso tawm cov cai thaum muaj xwm txheej ceev, Cloudflare: Kev tiv thaiv tsis siv neeg rau txhua theem thaum React traffic yog proxied nrog rau AWS, Akamai, Fastly, Google Cloud muaj cov cai tiv thaiv zoo sib xws. Pab kom cov kev tswj no tam sim ntawd los tsim ib txheej tiv thaiv thaum lub sijhawm hloov pauv.
Saib xyuas cov tsheb khiav HTTP uas tsis meej:
Teeb tsa kev sau npe thiab ceeb toom rau cov cim qhia txog kev sim siv tsis raug: Cov nqi them tsis raug lossis tsis tau xav txog ntawm RSC Flight protocol, cov qauv tsis zoo ntawm 500 qhov yuam kev ntawm RSC endpoints, POST thov nrog cov headers `Next-Action` lossis `Next-Router-State-Tree` uas tsis ntseeg, Rov ua cov lus thov rau `/_next/` txoj kev nrog ntau qhov them nyiaj.
Txheeb xyuas koj daim ntawv teev cov khoom siv software:
Muaj ntau lub frameworks uas muab RSC dependencies sib txuas ua ke kom pom tseeb, ua rau lawv tsis pom hauv kev tshuaj xyuas kev vam khom ntawm qhov chaw. Tshuaj xyuas koj cov ntaub ntawv tiav SBOM kom ntseeg tau tias: Tsis muaj kev vam khom rau cov pob khoom React server uas tsis muaj zog, cov kev hloov kho tshiab tsis tau qhia txog RSC cov kev siv qub.
kaw Xav
React2Shell yog ib qho ntawm cov teeb meem loj tshaj plaws ntawm JavaScript ecosystem nyob rau xyoo tas los no, tsis yog vim qhov kev siv tsis raug no nyuaj heev tab sis vim RSC khiav tob heev los ntawm cov cuab yeej niaj hnub no. Tam sim no uas cov patches muaj nyob thoob plaws hauv ecosystem, cov pab pawg yuav tsum thawb cov kev hloov kho tshiab mus rau hauv kev tsim khoom sai li sai tau.
Yog tias koj daim ntawv thov siv React cov yam ntxwv ntawm lub server, txawm tias ncaj qha lossis tsis ncaj qha, koj yuav tsum kho qhov tsis muaj zog no ua qhov kev kho tseem ceeb tshaj plaws.
