TL; DR
I-React2Shell (CVE-2025-55182) kudala okubalulekile Ingozi ye-RCE yonkana Izingxenye Zeseva Yokusabela (i-RSC) kanye nezinhlaka ezizihlanganisa, okuhlanganisa OkulandelayoNgoba ubuthakathaka buhlala ngaphakathi RSC ungqimba lokuhlukanisa kanye nokwehlukanisa, abahlaseli bangathumela isicelo se-HTTP esenziwe ngobuciko kanye ne-trigger ukusetshenziswa kwekhodi ekude okungagunyaziwe, noma ngabe amaqembu asebenzisa ukucushwa kohlaka okuzenzakalelayo. Okulandelayo izinhlelo zokusebenza zibhekene nokuchayeka okuphezulu kakhulu ngoba ziyazamukela futhi ziyazicubungula Indiza Yokusabela ukulayisha okukhokhelwayo nge-HTTP ngokuzenzakalelayo.
Iphutha lithinta izinhlobo eziningi ze Amaphakheji eseva ye-React, futhi abahlaseli abadingi i-logic yesicelo esenziwe ngokwezifiso ukuze bayisebenzise. Abacwaningi bezokuphepha babonisa ukuthembeka okucishe kube yi-100%, futhi ukuskena kwasekuqaleni kwembula ukuthi izindawo eziningi zamafu zisengozini Okulandelayo izimo. Amaqembu kumele alungise ngokushesha futhi baqinisekise uhlelo lwabo oluphelele lwemvelo ukuze banciphise Ingozi ye-React2Shell (CVE-2025-55182) RCE.
Ubuthakathaka obukhulu obubikwe ngohlelo lwe-Meta lokuthola amaphutha ngoNovemba 29 bubangele izimpendulo eziphuthumayo kulo lonke uhlelo lwe-JavaScript.
Khethiwe I-CVE-2025-55182, okwembulwe ngoDisemba 3 manje okubizwa ngokuthi I-React2Shell kuyinkinga enkulu kakhulu ethinta Izingxenye Zeseva Esabelayo kanye nezinhlaka ezizihlanganisayo. Ekuqaleni, kwanikezwa isihlonzi sobungozi se-Next.js (CVE-2025-66478) esihlukile, kodwa i-NVD kamuva yasihlanganisa ne-React CVE eyinhloko njengokufakwa okuphindwe kabili.
Inkinga eyisisekelo iyafana, ukuphathwa okungaphephile kwemithwalo ye-RSC elayishiwe nge-serialized engabangelwa isicelo se-HTTP. Lokhu kuvula ithuba lokuthi umenzi we-malware athumele isicelo se-HTTP esishintshiwe esiholela ekusebenzeni kwe-JavaScript ngokungafanele kuseva ngemuva kokuba isuswe ohlwini yi-React.
Ukubuka konke kwe-CVE-2025-55182
Izingxenye ze-React Server zihlanganiswe ngokujulile nezinhlaka zesimanje, futhi ezimweni eziningi zivulwa ngokuzenzakalelayo. Ngenxa yalokhu, izinhlelo zokusebenza zingase zivezwe ku I-React2Shell (CVE-2025-55182) noma ngabe abakaze bachaze ngokucacile i-endpoint ye-Server Function. Ukuqaliswa kwe-RSC kusekhona, futhi lokho kukodwa kwanele ukusebenzisa izindlela zekhodi ezisengozini nokudala okubalulekile Ingozi ye-RCE.
Iphutha livela endleleni Iphrothokholi ye-React FlightI-l icubungula imithwalo ethile ehleliwe. Izinguqulo ezindala zazama ukuhamba ngezindlela zezinto ezinikezwe kumthwalo wemfanelo ngaphandle kokuqinisekisa ukuthi isakhiwo siyasebenza noma silindelwe. Umhlaseli angalawula le nqubo futhi ekugcineni afinyelele ekusetshenzisweni kwekhodi kuseva. Akukho ukuqinisekiswa, akukho ukucushwa okukhethekile, futhi akukho logic ethile yohlelo lokusebenza edingekayo. Njengoba inkinga ikhona ekucushweni okungaphandle kwebhokisi, standard ukuthunyelwa kuvezwa ngaphandle kokudinga noma yiziphi izimo ezingavamile.
Ukuxhashazwa kwenzeka lapho abahlaseli bethumela izicelo ze-HTTP POST ezinonya ezisebenzisa kabi i-“vm.runInThisContext"indlela ngokusebenzisa Izenzo Zeseva. Ngenkathi i-React ingadaluli ngokuqondile indawo yokugcina esengozini, i-Next.js iyayidalula, idala i-vector yangempela yokuhlasela okukude.
I-Next.js yamukela imithwalo yokukhokha ye-Flight kusuka kunoma yisiphi isicelo, iyicubungule ngaphandle kokuqinisekiswa okufanele, bese iyidlulisela ku-deserializer ye-React. Uhlelo luphatha lokhu okufakwayo kwangaphandle njengokuthembekile, okuvumela abahlaseli ukuthi bafeze ukwenziwa kwekhodi okukude ngokusebenzisa izindawo zokugcina ezifinyeleleka emphakathini ngamalungelo aphelele enqubo ye-Node.js kuseva eqondiwe.
Ubunzima bukhula kakhulu ngoba ukucushwa okuzenzakalelayo kuhlala kusengozini I-React2Shell (CVE-2025-55182) kanye nomphumela Ingozi ye-RCE. A standard Uhlelo lokusebenza lwe-Next.js olwenza ngalo create-next-app iziveza ngaphandle kokudinga noma yiziphi izinguquko zekhodi yangokwezifiso noma ukucushwa. Abacwaningi bezokuphepha baqinisekisa ukuthembeka kokusetshenziswa okucishe kube yi-100% futhi babika ukuthi ama-39% ezindawo zamafu asebenzisa izimo ezisengozini, kuyilapho ama-44% azo zonke izindawo asebenzisa izinhlelo zokusebenza ze-Next.js ezithintwe yi- I-React2Shell.
Ukuqonda Ukuchayeka ku-React2Shell
Izinguqulo ezisengozini zihlanganisa ukukhishwa okuningi:
| Uphiko | Izinguqulo Ezithintekile |
|---|---|
| react-server-dom-webpack | 19.0, 19.1.0, 19.1.1, 19.2.0 |
| iphasela-le-domain-lokusabela-leseva | 19.0, 19.1.0, 19.1.1, 19.2.0 |
| i-react-server-dom-turbopack | 19.0, 19.1.0, 19.1.1, 19.2.0 |
Ngenxa yokuthi izinhlaka eziningi zifaka usekelo lwe-RSC enkabeni, izinhlelo zokusebenza zivame ukuzuza ikhodi esengozini ngaphandle kokuqaphela. Noma yiluphi uhlaka noma i-bundler ethumela la maphakheji ingadalula uhlelo lokusebenza ku-React2Shell (CVE-2025-55182) kanye nengozi yalo ye-RCE. Lokho kufaka phakathi:
- I-Next.js (i-router yohlelo lokusebenza)
- Ukuhlola kuqala kwe-React Router RSC
- Vite RSC plugin
- I-plugin ye-Parcel RSC
- I-Redwood SDK
- Waku
- Expo
I-Next.js ithinteka kakhulu ngoba isebenzisa ama-endpoint ahlobene ne-RSC ngaphezu kwe-HTTP ngokuzenzakalelayo. Izinguqulo eziqala ngo- 14.3.0 izakhiwo ze-canary, kanye neningi 15.x futhi ekuqaleni 16.x ukukhishwa, kuqukethe ukusetshenziswa okusengozini. Noma ubani osebenzisa i-canary 14.3.0-canary.77 noma kamuva kufanele buyela ku- izinzile 14.x igatsha kuze kube yilapho inguqulo ye-canary elungisiwe ishicilelwe.
Izinguqulo ze-Next.js ezilungisiwe Faka:
| Uphiko | Izinguqulo Ezihlanganisiwe |
|---|---|
| Okulandelayo | 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7 |
Ama-PoC Omphakathi Nokutholwa Okuthembekile
Ngemva kokudalulwa kobungozi, imibono eminingi eyayibhekwa njengobufakazi bemibono yaqala ukusabalala. Eminingi yayo yayinganembile noma isekelwe ekucabangeni okunephutha. Umbhali wokuqala wobungozi, uLachlan Davidson, ukuqinisekisile obala ku- i-react2shell ukuthi ama-GitHub PoC ajikelezayo awafani nokuxhashazwa okwabiwe ngasese nabanakekeli beReact/Next.js futhi anikeze i-PoC yakho.
Inkinga enkulu ngemizamo yokuqala yomphakathi ukwehluleka kwabo ukuqaphela ukuthi ukuxhashazwa kuyaphumelela ngokumelene standard Ukufakwa kwe-Next.js ngaphandle kokudinga ukuthi kube khona i-logic ethile yohlelo lokusebenza noma imisebenzi eseceleni kweseva.
Abacwaningi bezokuphepha abavela ezinhlanganweni eziningi bagcizelele ukuthi ukuthola ubuthakathaka kudinga okungaphezu nje kokubona ukuthi i-RSC ikhona yini. Ithimba le-Assetnote lishicilele i- indlela yokuthola ethembekile futhi isithwebuli ekwazi ukuqinisekisa inkinga ngaphandle kokusebenzisa noma yiluphi uhlobo lokuxhaphaza. I-Metasploit maduze izoba ne- ukuxhashazwa okutholakalayo nangalobu buthakathaka.
Indlela yokuthola isebenzisa indlela i-React Server ephatha ngayo izinkomba zempahla yezinto isebenzisa ama-delimiters ekholoni ngaphakathi kwe- I-ReactFlightClientConfigBundlerWebpack.js/requireModule() umsebenzi. Lapho izinguqulo ezisengozini zicubungula umthwalo ohleliwe ngokukhethekile wezingxenye eziningi ozama ukuwela ezindleleni zezinto ezingenalutho ezifakwe izidleke, zibangela izimpendulo zamaphutha ezingalindeleka. Isicelo sokuxilonga sithumela iphethini yokubhekisela efana `$1:a:a` kubhangqwe nento engenalutho. Ukuqaliswa okusengozini kuzama ukuxazulula lokhu njengokufinyelela kwempahla okufakwe esidlekeni ngenani elingachazwanga, okuholela kokuhlukile. Iseva ibuyisela isimo esingu-500 ngephethini ehlukile yokugaya iphutha emzimbeni wempendulo.
export function requireModule<T>(metadata: ClientReference<T>): T { let moduleExports = __webpack_require__(metadata[ID]); if (isAsyncImport(metadata)) { if (typeof moduleExports.then !== 'function') { // This wasn't a promise after all. } else if (moduleExports.status === 'fulfilled') { // This Promise should've been instrumented by preloadModule. moduleExports = moduleExports.value; } else { throw moduleExports.reason; } } if (metadata[NAME] === '*') { // This is a placeholder value that represents that the caller imported this // as a CommonJS module as is. return moduleExports; } if (metadata[NAME] === '') { // This is a placeholder value that represents that the caller accessed the // default property of this if it was an ESM interop module. return moduleExports.__esModule ? moduleExports.default : moduleExports; } return moduleExports[metadata[NAME]]; } Izenzo Ezisheshayo Zezinhlangano Ezibhekene Ne-React2Shell (CVE-2025-55182) kanye Nengozi Ye-RCE
Yenza ukuskena okuphelele kwe-codebase yakho kanye nezinhlelo zokusebenza ezisetshenzisiwe ukuthola izinguqulo zephakheji ezisengozini. Naka ngokukhethekile ukuncika kwephakheji yeseva ye-React ngqo, ukuqaliswa kwe-RSC kwezinga lohlaka (i-Next.js, i-Waku, i-Redwood, njll.), izinhlelo zokusebenza ezakhiwe nge-`create-next-app` noma amathuluzi afanayo e-scaffolding kanye nezinhlelo zokusebenza ezifakwe ezitsheni ezingase zibe nezithombe zesisekelo eziphelelwe yisikhathi.
Ukuhlaziywa Kokwakheka Kwesofthiwe (SCA) amathuluzi afana I-Xygeni's SCA ingathola ngokuzenzakalelayo ukuncika okuthintekile kuyo yonke impahla yakho yesofthiwe.
Patch ngokushesha:
Buyekeza izinguqulo ezilungisiwe njenge-React (19.0.1, 19.1.2, 19.2.1), i-Next.js (15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7) kanye nanoma yimaphi amaphakheji ohlaka afaka i-RSC. Lezi zibuyekezo zethula ukuqinisekiswa okuqinile kokuphathwa kwemithwalo ye-RSC futhi zivimbela ukuhoxiswa kwempahla engaphephile okuvumela ukuxhashazwa.
Amathuluzi okulungisa okuzenzakalelayo, njenge Isici se-Xygeni sokulungisa ngokuzenzakalelayo, ingasheshisa inqubo kuwo wonke ama-codebase amakhulu.
Sebenzisa Ukuvikelwa Kwesikhashana kwe-WAF:
Ngenkathi ama-patches esakazeka ngokufakwa kwakho pipeline, sebenzisa imithetho ye-Web Application Firewall ukuze uvikeleke ngokushesha. Abahlinzeki abakhulu bamafu bakhiphe amasethi emithetho ephuthumayo, I-Cloudflare: Ukuvikelwa okuzenzakalelayo kwazo zonke izigaba lapho ithrafikhi ye-React ivikelwe kanye I-AWS, i-Akamai, i-Fastly, i-Google Cloud banemithetho efanayo yokuzivikela etholakalayo Vumela lezi zilawuli ngokushesha ukudala ungqimba oluvikelayo ngesikhathi sokuguquka.
Gada ithrafikhi ye-HTTP esolisayo:
Lungiselela ukuloga nokuxwayisa ngezinkomba zemizamo yokuxhaphaza: Imithwalo ye-payloads ye-RSC Flight engakahleleki noma engalindelekile, amaphethini angavamile amaphutha angu-500 kuma-endpoints e-RSC, izicelo ze-POST ezinezihloko ze-`Next-Action` noma ze-`Next-Router-State-Tree` ezisolisayo, Izicelo eziphindaphindwayo ezindleleni ze-`/_next/` ezinemithwalo ye-payloads eningi
Qinisekisa i-Software Bill of Materials yakho:
Ama-framework amaningi ahlanganisa ukuncika kwe-RSC ngokusobala, okwenza kungabonakali ekubuyekezweni kokuncika kwezinga eliphezulu. Hlola konke kwakho SBOM ukuqinisekisa: Akukho ukuncika okuguqukayo kumaphakheji eseva ye-React asengozini okusele, izibuyekezo zohlaka azizange zethule ngokungaqondile ukusetshenziswa kwe-RSC okudala.
Ukuvala Thoughts
I-React2Shell iphakathi kobuthakathaka obukhulu kakhulu be-JavaScript ecosystem eminyakeni yamuva nje, hhayi ngoba ukusetshenziswa kwayo kuyinkimbinkimbi kodwa ngoba i-RSC isebenza ngokujulile ngokusebenzisa amathuluzi anamuhla. Manje njengoba ama-patches esetholakala kuyo yonke i-ecosystem, amaqembu kumele athuthukise ukuthuthukiswa ekukhiqizweni ngokushesha okukhulu.
Uma uhlelo lwakho lokusebenza lusebenzisa izici zeseva ye-React, kungakhathaliseki ukuthi ziqondile noma zingaqondile, kufanele uphathe lobu buthakathaka njengento ebaluleke kakhulu.
