TL; DR
React2Shell (CVE-2025-55182) ka waihanga i tētahi kaupapa arohaehae Mōrearea RCE puta noa Ngā Wāhanga Tūmau React (RSC) me ngā anga e whakauru ana i aua anga, tae atu ki Whai muri.jsNā te mea kei roto i te RSC te paparanga raupapatanga me te paparanga whakakore raupapatanga, ka taea e ngā kaiwhakaeke te tuku tono HTTP kua hangaia me te whakaoho te whakahaerenga waehere mamao kāore i whakamanahia, ahakoa ka whakahaerehia e ngā tīma ngā whirihoranga anga taunoa. Whai muri.js Ko ngā tono te hunga e tino kitea ana, nā te mea ka whakaaetia, ka tukatukahia hoki Rererangi Tauhohe ngā kawenga mā te HTTP hei taunoa.
Ka pā te hapa ki ngā putanga maha o Ngā mōkihi tūmau tauhohe, ā, kāore e hiahiatia ana e ngā kaiwhakaeke he arorau tono ritenga hei whakamahi. E whakaatu ana ngā kairangahau haumarutanga i te tata ki te 100% te pono, ā, e whakaatu ana ngā matawai wawe he maha ngā taiao kapua e ngoikore ana. Whai muri.js ngā tauira Me whakatika tonu ngā tīma me te whakamana i tā rātou pūnaha rauropi katoa hei whakaiti i te Te mōrearea RCE o React2Shell (CVE-2025-55182).
Nā te kaupapa utu hapa a Meta i te 29 o Noema, i puta ai he ngoikoretanga nui kua puta i te pūnaha JavaScript, ā, kua puta he urupare tere.
Kua tohua CVE-2025-55182, i whakakitea i te 3 o Hakihea e kiia nei inaianei ko React2Shell he ngoikoretanga tino kino e pā ana ki Tauhohe Waenga Tūmau me ngā anga e whakauru ana i aua anga. I te tīmatanga, i tohaina he tohu whakaraeraetanga Next.js motuhake (CVE-2025-66478), engari i muri mai ka whakakotahihia e te NVD ki roto i te React CVE matua hei tāurunga tārua.
Ko te take matua ko te whakahaerenga haumaru o ngā utunga RSC raupapa ka taea te whakaoho mā te tono HTTP. Mā tēnei ka huaki te kuaha mō tētahi kaiwhakaari kino ki te tuku tono HTTP kua whakarerekētia, ka hua ake he JavaScript e rere ana i runga i te tūmau i muri i te kua tangohia te raupapatanga e React.
Tirohanga whānui o te CVE-2025-55182
Kua whakauruhia rawatia ngā Wāhanga Tūmau React ki roto i ngā anga hou, ā, i te nuinga o te wā ka whakahohea mā te taunoa. Nā tēnei, ka tūpono pea ngā tono ki React2Shell (CVE-2025-55182) ahakoa kāore rātou e tautuhi mārama i tētahi pito mutunga Mahi Tūmau. Kei te noho tonu te whakatinanatanga RSC, ā, he nui noa iho tēnā hei whakahohe i ngā ara waehere ngoikore me te waihanga i tētahi mea nui Mōrearea RCE.
Ko te hapa i ahu mai i te ara i Kawa React FlightKa tukatukahia e l ētahi kawenga hanganga. I ngana ngā putanga tawhito ki te hikoi i ngā ara ahanoa i tukuna i roto i te kawenga me te kore e manatoko he tika, he tumanakohia rānei te hanganga. Ka taea e te kaiwhakaeke te whakahaere i tēnei tukanga, ā, i te mutunga ka tae ki te whakatinanatanga waehere i runga i te tūmau. Kāore he manatoko, kāore he whirihoranga motuhake, ā, kāore he arorau taupānga-motuhake e hiahiatia ana. Nā te mea kei roto te raruraru i ngā whirihoranga o waho, standard ka whakaatuhia ngā whakatinanatanga me te kore e hiahiatia he āhuatanga rerekē.
Ka puta te mahi kino ina tukuna e ngā kaiwhakaeke ngā tono HTTP POST kino e tukino ana i te "vm.runInThisContext"tikanga mā roto i ngā Mahi Tūmau. Ahakoa kāore a React e whakaatu tika i te pito mutunga ngoikore, ka mahi a Next.js, ka hangaia he ara whakaeke mamao tūturu.
Ka whakaaetia e Next.js ngā utunga rere mai i tētahi tono, ka tukatukahia me te kore whakamana tika, ka tukuna ki te deserializer a React. Ka whakaarohia e te pūnaha ēnei tāurunga o waho he mea pono, ka taea ai e ngā kaiwhakaeke te whakatutuki te whakahaere waehere mamao mā roto i ngā pūwāhi e taea ai e te marea te uru atu me ngā mana katoa o te tukanga Node.js i runga i te tūmau ūnga.
Ka tino piki ake te kino nā te mea kei te noho ngoikore tonu ngā whirihoranga taunoa ki React2Shell (CVE-2025-55182) me te hua Mōrearea RCE. He standard Taupānga Next.js ka hangaia e koe create-next-app ka whakaatu i a ia anō me te kore e hiahiatia he waehere ritenga, he huringa whirihoranga rānei. E whakaū ana ngā kairangahau haumarutanga i te tata ki te 100% te pono o te whakamahinga, ā, e ai ki tā rātou 39% o ngā taiao kapua e whakahaere ana i ngā tauira ngoikore, ko te 44% o ngā taiao katoa e whakahaere ana i ngā tono Next.js e tūmatanuitia ana e pāngia ana e React2Shell.
Te Mārama ki te Whakaraeraetanga ki a React2Shell
Kei roto i ngā putanga ngoikore ngā tukunga maha:
| Wae | Ngā Putanga e Pāngia ana |
|---|---|
| react-server-dom-webpack | 19.0, 19.1.0, 19.1.1, 19.2.0 |
| te mōkihi-dom-server-tauhohe | 19.0, 19.1.0, 19.1.1, 19.2.0 |
| pūtukatuka-turbo-dom-tauhohe-tūmau | 19.0, 19.1.0, 19.1.1, 19.2.0 |
Nā te mea he maha ngā anga e whakauru ana i te tautoko RSC ki te pūtake, he maha ngā wā ka riro mai i ngā tono te waehere ngoikore me te kore e mōhio. Ka taea e tetahi anga, tetahi paihere rānei e tuku ana i ēnei mōkihi te whakaatu i te tono ki a React2Shell (CVE-2025-55182) me tōna mōrearea RCE. Kei roto i tēnā:
- Next.js (Pouara taupānga)
- Arokite RSC o te Pouara React
- Monomai Vite RSC
- Monomai RSC mōkihi
- SDK Redwood
- Waku
- Whakaaturanga
Ka tino pāngia a Next.js nā te mea ka whakamahia e ia ngā pito mutunga e pā ana ki te RSC mā te HTTP i te taunoa. Ko ngā putanga e tīmata ana me te 14.3.0 ngā hanganga o te kanari, me te nuinga 15.x me te wawe 16.x ngā tukunga, kei roto te whakatinanatanga ngoikore. Ko te hunga katoa e whakahaere ana i te canary 14.3.0-canary.77 ā muri ake rānei me hoki ki te pumau 14.x peka kia whakaputaina rā anō he putanga canary kua papakihia.
Ngā putanga Next.js kua papakihia ngā:
| Wae | Ngā Putanga Kua Papakihia |
|---|---|
| Whai muri.js | 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7 |
Ngā PoC Tūmatanui me te Kimi Pono
Whai muri i te whakakitenga o te ngoikoretanga, he maha ngā taunakitanga ariā i tīmata te horapa haere. He maha o aua taunakitanga he hē, he whakapae hē rānei. Nā te kaituhi taketake o te ngoikoretanga, nā Lachlan Davidson, i whakaū i te iwi whānui react2shell kāore ngā PoC GitHub e horapa ana e ōrite ana ki te mahi tinihanga i tohaina motuhake ki ngā kaitiaki React/Next.js, ā, i whakaratohia e ia ake PoC.
Ko tētahi raruraru nui o ngā nganatanga tūmatanui tuatahi ko tā rātou kore e mōhio he angitu te mahi tukino ki standard Ngā whakatinanatanga o Next.js me te kore e hiahiatia he arorau taupānga motuhake, he mahi taha-tūmau rānei.
Kua whakanuia e ngā kairangahau haumarutanga mai i ngā whakahaere maha, ko te kimi i te ngoikoretanga me nui atu i te tautuhi noa mēnā kei reira te RSC. I whakaputa te tīma a Assetnote i tētahi tikanga kimi pono me te matawai ka taea te whakaū i te take me te kore e whakamahi i tētahi arorau whakamahi. Ka tata te whai a Metasploit i tētahi whakamahi e wātea ana mō tēnei ngoikoretanga anō hoki.
Ka whakamahia e te huarahi kimi te huarahi e whakahaere ai a React Server i ngā tohutoro āhuatanga ahanoa mā te whakamahi i ngā wehewehenga koroni i roto i te ReactFlightClientConfigBundlerWebpack.js/requireModule() mahi. Ina tukatukahia e ngā putanga ngoikore tētahi kawenga maha-wāhanga kua whakaritea motuhake e ngana ana ki te whakawhiti i ngā ara mea kua whakapūmauhia kāore i te tīariari, ka whakaohohia e rātou ngā urupare hapa matapae. Ka tukuna e te tono tātaritanga he tauira tohutoro pēnei i `$1:a:a` ka honoa ki tētahi mea kau. Ka ngana ngā whakatinanatanga ngoikore ki te whakatau i tēnei hei urunga āhuatanga kōpuku i runga i tētahi uara kāore i tautuhia, ka hua ake he okotahi. Ka whakahokia mai e te tūmau he tūnga 500 me tētahi tauira hapa motuhake i roto i te tinana urupare.
export function requireModule<T>(metadata: ClientReference<T>): T { let moduleExports = __webpack_require__(metadata[ID]); if (isAsyncImport(metadata)) { if (typeof moduleExports.then !== 'function') { // This wasn't a promise after all. } else if (moduleExports.status === 'fulfilled') { // This Promise should've been instrumented by preloadModule. moduleExports = moduleExports.value; } else { throw moduleExports.reason; } } if (metadata[NAME] === '*') { // This is a placeholder value that represents that the caller imported this // as a CommonJS module as is. return moduleExports; } if (metadata[NAME] === '') { // This is a placeholder value that represents that the caller accessed the // default property of this if it was an ESM interop module. return moduleExports.__esModule ? moduleExports.default : moduleExports; } return moduleExports[metadata[NAME]]; } Ngā Mahi Tonu mō ngā Whakahaere e Pa Ana ki a React2Shell (CVE-2025-55182) me te Mōrearea RCE
Whakahaerehia he matawai whānui o tō pūtake waehere me ngā tono kua whakatinanahia ki te kimi i ngā putanga mōkihi ngoikore. Kia aro nui ki ngā whakawhirinakitanga mōkihi tūmau React tika, ngā whakatinanatanga RSC taumata-Anga (Next.js, Waku, Redwood, me ētahi atu), ngā tono i hangaia ki te `create-next-app` me ngā taputapu hanganga rite, me ngā tono ipu kei roto pea ngā whakaahua turanga tawhito.
Tātaritanga Hanganga Pūmanawa (SCA) ngā taputapu pērā i Xygeni's SCA ka taea te kimi aunoa i ngā whakawhirinakitanga kua pāngia puta noa i tō rarangi pūmanawa.
Pātaki tonu:
Whakahōu ki ngā putanga kua papakihia pērā i a React (19.0.1, 19.1.2, 19.2.1), Next.js (15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7) me ngā mōkihi anga katoa kei roto ko te RSC. Mā ēnei whakahōutanga ka whakauruhia he manatoko tino pakari mō te whakahaere i ngā kawenga RSC, ā, ka ārai i te tango tohutoro o te āhuatanga haumaru kore e āhei ai te whakamahi kino.
Ngā taputapu whakatika aunoa, pērā i Āhuatanga whakatika-aunoa a Xygeni, ka taea te whakatere i te tukanga puta noa i ngā pūtake waehere nui.
Whakatinanahia ngā Parenga WAF Wāpoto:
I te horapa haere o ngā papaki puta noa i tō whakatinanatanga pipeline, whakahohehia ngā ture Pātūahi Taupānga Tukutuku hei tiaki tonu. Kua tukuna e ngā kaiwhakarato kapua nui ngā huinga ture ohorere, CloudflareTe tiakitanga aunoa mō ngā taumata katoa ina he āpiti te haere o React me te AWS, Akamai, Fastly, Google Cloud kia rite ngā ture parepare e wātea ana Whakahohehia tonutia ēnei mana whakahaere hei waihanga i tētahi paparanga tiaki i te wā whakawhiti.
Aroturukihia ngā waka HTTP whakapae:
Whirihorahia te takiuru me te whakatūpato mō ngā tohu o ngā nganatanga whakamahi kino: Ngā kawenga kawa rere RSC hē, kāore rānei i te tūmanakohia, ngā tauira rerekē o ngā hapa 500 i ngā pito mutunga RSC, ngā tono POST me ngā pane whakapae `Mahi-Panuku` `Router-State-Tree` rānei, Ngā tono anō ki ngā ara `/_next/` me ngā kawenga maha-wāhanga
Manatokohia tō Pūrongo Rauemi Pūmanawa:
He maha ngā anga e whakakotahi ana i ngā whakawhirinakitanga RSC kia mārama, kia kore ai e kitea i roto i ngā arotake whakawhirinakitanga taumata-mata. Tirohia ō taipitopito katoa SBOM hei whakarite: Kāore he whakawhirinakitanga whakawhiti i runga i ngā mōkihi tūmau React ngoikore e toe ana, kāore ngā whakahoutanga anga i whakauru pōhēhē i ngā whakatinanatanga RSC tawhito.
Ko nga whakaaro e pa ana
Ko React2Shell tētahi o ngā ngoikoretanga tino kino o te pūnaha JavaScript i ngā tau tata nei, ehara i te mea he uaua te whakamahi engari nā te mea he tino hohonu te mahi a RSC i roto i ngā taputapu o ēnei rā. Nā te mea kei te wātea ngā papaki puta noa i te pūnaha, me tere tonu te pana a ngā tīma i ngā whakapainga ki te whakaputa.
Mena kei te whakamahi tō taupānga i ngā āhuatanga tūmau a React, ahakoa he tika, he kore tika rānei, me whakaaro koe ki tēnei ngoikoretanga hei whakatikatika matua.
