TL; DR
I-React2Shell (CVE-2025-55182) idala into ebalulekileyo Umngcipheko we-RCE ngaphesheya Iinxalenye zeSeva yeReact (RSC) kunye nezikhokelo ezizifakela, kuquka Okulandelayo.jsKuba ubuthathaka buhlala ngaphakathi RSC ukulandelelanisa kunye nokwehliswa kwe-serialization, abahlaseli banokuthumela isicelo se-HTTP esenziwe ngobuchule kunye ne-trigger ukuphunyezwa kwekhowudi ekude engaqinisekiswanga, nokuba amaqela asebenzisa uqwalaselo oluzenzekelayo lwesakhelo. Okulandelayo.js izicelo zijongene nokuvezwa okuphezulu kuba ziyamkela kwaye ziyayicubungula I-React Flight ukulayisha imithwalo ngaphezulu kwe-HTTP ngokuzenzekelayo.
Impazamo ichaphazela iinguqulelo ezininzi ze Iiphakheji zeseva ye-React, kwaye abahlaseli abadingi logic yesicelo esenziwe ngokwezifiso ukuze bayisebenzise. Abaphandi bokhuseleko babonisa ukuthembeka okuphantse kube yi-100%, kwaye ukuskena kwangethuba kubonisa ukuba iindawo ezininzi zamafu zisengozini. Okulandelayo.js iimeko. Amaqela kufuneka alungise izinto ngoko nangoko kwaye baqinisekise inkqubo yabo yonke ye-ecosystem ukuze banciphise Umngcipheko we-React2Shell (CVE-2025-55182) RCE.
Ubuthathaka obukhulu obubikwe yinkqubo ye-Meta's bug bounty ngomhla wama-29 kweyeNkanga bubangele iimpendulo ezingxamisekileyo kuyo yonke inkqubo yeJavaScript.
Yenzelwe I-CVE-2025-55182, yatyhilwa ngoDisemba 3 ngoku ebizwa ngokuba yi I-React2Shell bubuthathaka obukhulu obuchaphazela Amacandelo eSeva esabelayo kunye neefreyimu ezizibandakanyayo. Ekuqaleni, i-Next.js vulnerability identifier eyahlukileyo (CVE-2025-66478) yanikwa, kodwa i-NVD kamva yayidibanisa kwi-React CVE yokuqala njengongeniso oluphindwe kabini.
Ingxaki esisiseko iyafana, ukuphathwa ngendlela engakhuselekanga kwemithwalo ye-RSC elandelelanayo enokubangelwa sisicelo se-HTTP. Oku kuvula ithuba lokuba umenzi we-malware athumele isicelo se-HTTP esilawulwayo esikhokelela ekubeni iJavaScript isebenze ngokungacwangciswanga kwiseva emva kokuba ifakiwe. isuswe kwi-serial yiReact.
CVE-2025-55182 Ushwankathelo
IiReact Server Components zidityaniswe nzulu kwiiframework zanamhlanje, kwaye kwiimeko ezininzi zivulwa ngokungagqibekanga. Ngenxa yoku, usetyenziso lunokuvezwa kwi I-React2Shell (CVE-2025-55182) nokuba abakaze bayichaze ngokucacileyo isiphelo seServer Function. Ukuphunyezwa kwe-RSC kusekhona, kwaye oko kukodwa kwanele ukuvula iindlela zekhowudi ezibuthathaka kunye nokudala okubalulekileyo Umngcipheko we-RCE.
Ingxaki ivela kwindlela Iprotokholi yeReact FlightI-l icwangcisa imithwalo ethile yokuhlawula eyakhiweyo. Iinguqulelo ezindala zizame ukuhamba ngeendlela zezinto ezibonelelweyo kumthwalo wokuhlawula ngaphandle kokuqinisekisa ukuba isakhiwo siyasebenza okanye silindelwe. Umhlaseli angalulawula olu nkqubo aze ekugqibeleni afikelele ekusebenziseni ikhowudi kwiseva. Akukho kuqinisekiswa, akukho lungiselelo lukhethekileyo, kwaye akukho logic ethile ye-app efunekayo. Ekubeni ingxaki ikhona kwiindlela zokulungiselela ezingaphandle kwebhokisi, standard ukuthunyelwa kuvezwa ngaphandle kwemfuneko yeemeko ezingaqhelekanga.
Ukuxhaphaza kwenzeka xa abahlaseli bethumela izicelo ze-HTTP POST ezinobungozi ezisebenzisa kakubi i-“vm.runInThisContext"indlela yokusebenza ngeSeva yeZenzo. Nangona iReact ingabonisi ngokuthe ngqo isiphelo esibuthathaka, iNext.js iyasityhila, idala i-vector yohlaselo olukude yokwenyani.
I-Next.js iyayamkela imithwalo yeFlight evela kuyo nayiphi na isicelo, iyicubungule ngaphandle kokuqinisekiswa okufanelekileyo, ize iyidlulisele kwi-deserializer yeReact. Inkqubo ithatha la magalelo angaphandle njengethembekileyo, ivumela abahlaseli ukuba bafikelele kwi ukuphunyezwa kwekhowudi ekude ngokusebenzisa iindawo zokugqibela ezifikeleleka esidlangalaleni ngamalungelo apheleleyo enkqubo yeNode.js kwiseva ekujoliswe kuyo.
Ubunzima buyanda kakhulu kuba uqwalaselo oluzenzekelayo luhlala lusengozini I-React2Shell (CVE-2025-55182) kunye nesiphumo Umngcipheko we-RCE. A standard Usetyenziso lweNext.js olwenzayo create-next-app iziveza ngaphandle kokufuna naluphi na utshintsho kwikhowudi yesiko okanye kuqwalaselo. Abaphandi bokhuseleko baqinisekisa ukuthembeka kokusetyenziswa kwayo phantse nge-100% kwaye baxela ukuba i-39% yeendawo ezikwilifu zisebenza kwiimeko ezibuthathaka, ngelixa i-44% yazo zonke iindawo zisebenza zibonakala esidlangalaleni kwizicelo ze-Next.js ezichaphazeleka yi I-React2Shell.
Ukuqonda Ukuvezwa kwiReact2Shell
Iinguqulelo ezibuthathaka zigubungela ukukhutshwa okuninzi:
| ilungu | Iinguqulelo Ezichaphazelekayo |
|---|---|
| i-react-server-dom-webpack | 19.0, 19.1.0, 19.1.1, 19.2.0 |
| i-react-server-dom-parcel | 19.0, 19.1.0, 19.1.1, 19.2.0 |
| i-react-server-dom-turbopack | 19.0, 19.1.0, 19.1.1, 19.2.0 |
Ngenxa yokuba iiframeworks ezininzi zixhasa inkxaso ye-RSC, ii-aplikeshini zihlala zizuza ikhowudi ebuthathaka ngaphandle kokuyiqonda. Nasiphi na iframework okanye i-bundler ethumela ezi phakheji inokubeka usetyenziso kwiReact2Shell (CVE-2025-55182) kunye nomngcipheko wayo we-RCE. Oko kuquka:
- I-Next.js (i-router ye-app)
- React Router RSC preview
- Vite iplagi ye-RSC
- Iplagi ye-RSC yePasi
- I-SDK yeRedwood
- Waku
- Expo
I-Next.js ichaphazeleka kakhulu kuba isebenzisa ii-endpoints ezinxulumene ne-RSC ngaphezu kwe-HTTP ngokuzenzekelayo. Iinguqulelo eziqala ngo 14.3.0 izakhiwo ze-canary, kunye nenkoliso 15.x nakusasa 16.x ukukhutshwa, kuquka ukuphunyezwa okubuthathaka. Nabani na osebenzisa i-canary 14.3.0-canary.77 okanye kamva kufuneka buyela kwi izinzile 14.x isebe ide ipapashe inguqulelo ye-canary epetshiweyo.
Iinguqulelo zeNext.js ezilungisiweyo zibandakanya:
| ilungu | Iinguqulelo ezilungisiweyo |
|---|---|
| Okulandelayo.js | 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7 |
Ii-PoCs zikawonke-wonke kunye nokuchongwa okuthembekileyo
Emva kokutyhilwa kobuthathaka, iingcamango ezininzi ezazicingelwa ukuba zibubungqina balo mbandela zaqala ukusasazeka. Uninzi lwazo lwalungachanekanga okanye lusekelwe kwiingcamango ezineziphene. Umbhali wokuqala wobuthathaka, uLachlan Davidson, uqinisekisile esidlangalaleni kwi react2shell ukuba ii-GitHub PoCs ezijikelezayo azifani nokuxhaphazwa okwabelwana ngasese nabagcini beReact/Next.js kwaye zibonelele nge i-PoC yakho.
Ingxaki enkulu ngeenzame zokuqala zikawonke-wonke kukusilela kwabo ukuqonda ukuba ukuxhaphaza kuyaphumelela ngokuchasene standard Ukusasazwa kweNext.js ngaphandle kokufuna ukuba kubekho i-logic ethile yesicelo okanye imisebenzi esecaleni kweseva.
Abaphandi bezokhuseleko abavela kwimibutho emininzi bagxininise ukuba ukubona ubuthathaka kufuna okungaphezulu kokuchonga nje ukuba i-RSC ikhona na. Iqela le-Assetnote lipapashe inqaku indlela yokubhaqa ethembekileyo kunye a isikeni iyakwazi ukuqinisekisa ingxaki ngaphandle kokusebenzisa nayiphi na ingqiqo yokuxhaphaza. I-Metasploit kungekudala iza kuba ne- ukusetyenziswa okufumanekayo nangenxa yobu buthathaka.
Indlela yokufumanisa isebenzisa indlela iReact Server ephatha ngayo iireferensi zepropathi yezinto isebenzisa ii-colon delimiters ngaphakathi ReactFlightClientConfigBundlerWebpack.js/requireModule() umsebenzi. Xa iinguqulelo ezibuthathaka zicubungula umthwalo we-multipart ocwangcisiweyo ngokukodwa ozama ukunqumla iindlela zezinto ezingenanto, zibangela iimpendulo zempazamo ezinokuqikelelwa. Isicelo sokuxilonga sithumela ipateni yesalathiso efana `$1:a:a` idityaniswe nento engenanto. Ukuphunyezwa okusengozini kuzama ukusombulula oku njengokufikelela kwipropathi edibeneyo kwixabiso elingachazwanga, nto leyo ebangela ukuba kubekho i-exception. Iseva ibuyisela imeko ye-500 enepatheni eyahlukileyo yokugaya iimpazamo emzimbeni wempendulo.
export function requireModule<T>(metadata: ClientReference<T>): T { let moduleExports = __webpack_require__(metadata[ID]); if (isAsyncImport(metadata)) { if (typeof moduleExports.then !== 'function') { // This wasn't a promise after all. } else if (moduleExports.status === 'fulfilled') { // This Promise should've been instrumented by preloadModule. moduleExports = moduleExports.value; } else { throw moduleExports.reason; } } if (metadata[NAME] === '*') { // This is a placeholder value that represents that the caller imported this // as a CommonJS module as is. return moduleExports; } if (metadata[NAME] === '') { // This is a placeholder value that represents that the caller accessed the // default property of this if it was an ESM interop module. return moduleExports.__esModule ? moduleExports.default : moduleExports; } return moduleExports[metadata[NAME]]; } Amanyathelo Akhawulezileyo kwiMibutho Ejongene neReact2Shell (CVE-2025-55182) kunye noMngcipheko we-RCE
Yenza iskena esibanzi se-codebase yakho kunye nezicelo ezisetyenzisiweyo ukuze ufumane iinguqulelo zephakheji ezisengozini. Nika ingqalelo ekhethekileyo kwiindlela ezixhomekeke ngqo kwiphakheji yeseva yeReact, ukuphunyezwa kwe-RSC kwinqanaba leSakhelo (i-Next.js, iWaku, iRedwood, njl.njl.), usetyenziso olwakhiwe nge-`create-next-app` okanye izixhobo ezifanayo ze-scaffolding kunye nosetyenziso olukwisikhongozeli olunokuba nemifanekiso esisiseko yakudala.
Uhlalutyo loBume beSoftware (SCA) izixhobo ezifana IXygeni's SCA inokufumana ngokuzenzekelayo ukuxhomekeka okuchaphazelekileyo kuyo yonke impahla yakho yesoftware.
Yincamathisele ngoko nangoko:
Uhlaziyo kwiinguqulelo ezilungisiweyo ezifana neReact (19.0.1, 19.1.2, 19.2.1), Next.js (15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7) kunye nazo naziphi na iipakethi zesakhelo ezibandakanya i-RSC. Olu hlaziyo luzisa ukuqinisekiswa okungqongqo kokuphathwa kwemithwalo ye-RSC kwaye luthintela ukurhoxiswa kwereferensi yepropathi engakhuselekanga evumela ukusetyenziswa kakubi.
Izixhobo zokulungisa ezizenzekelayo, ezifana Isici seXygeni sokulungisa ngokuzenzekelayo, inokukhawulezisa inkqubo kwiikhowudi ezinkulu.
Sebenzisa uKhuseleko lwe-WAF lwexeshana:
Ngelixa ama-patches esasazeka ngokufakwa kwakho pipeline, sebenzisa imithetho ye-Web Application Firewall ukuze ukhuseleke ngokukhawuleza. Ababoneleli abakhulu belifu bakhuphe imithetho engxamisekileyo, Cloudflare: Ukhuseleko oluzenzekelayo kuzo zonke izigaba xa i-React traffic ixhomekeke kwi-proxied kunye I-AWS, i-Akamai, ngokukhawuleza, i-Google Cloud banemithetho efanayo yokuzikhusela ekhoyo. Vumela ezi zilawuli ngoko nangoko ukuba zenze umaleko wokukhusela ngexesha lotshintsho.
Jonga ithrafikhi yeHTTP ekrokrisayo:
Lungiselela ukuloga kunye nokulumkisa ngezibonakaliso zemizamo yokuxhaphaza: Imithwalo yeprotokholi ye-RSC Flight engalunganga okanye engalindelekanga, iipateni ezingaqhelekanga zeempazamo ezingama-500 kwiindawo zokugqibela ze-RSC, izicelo ze-POST ezineentloko ezikrokrisayo ze-`Next-Action` okanye ze-`Next-Router-State-Tree`, Izicelo eziphindaphindwayo kwiindlela ze-`/_next/` ezinemithwalo yentlawulo emininzi
Qinisekisa i-Software Bill of Materials yakho:
Iiframeworks ezininzi zidibanisa ukuxhomekeka kwe-RSC ngokucacileyo, nto leyo eyenza ukuba zingabonakali kuphononongo lokuxhomekeka kwinqanaba eliphezulu. SBOM ukuqinisekisa: Akukho zixhomekeko eziguqukayo kwiipakethi zeseva yeReact esesichengeni ezisele zikhona, uhlaziyo lwesakhelo aluzange lungenise ngokungaziyo ukuphunyezwa kweRSC endala.
Iingcamango Zokuvala
I-React2Shell iphakathi kwezona ngxaki zinkulu ze-JavaScript ecosystem kwiminyaka yakutshanje, kungengenxa yokuba i-exploit iyinkimbinkimbi kodwa ngenxa yokuba i-RSC isebenza kakhulu kwizixhobo zanamhlanje. Ngoku ekubeni ii-patches zifumaneka kuyo yonke i-ecosystem, amaqela kufuneka atyhale ukuphuculwa kwimveliso ngokukhawuleza.
Ukuba usetyenziso lwakho lusebenzisa iimpawu zeseva yeReact, nokuba ngokuthe ngqo okanye ngokungathanga ngqo, kufuneka uluphathe olu buthathaka njengolungiso oluphambili.
