Active Exploitation of Critical Vulnerability in React Server Components (RSC)

Active Exploitation of Critical Vulnerability in React Server Components (RSC)

Information:

  React is a JavaScript library used for building websites and web applications. It helps divide the user interface into smaller reusable parts called components, making development and maintenance easier. React primarily operates on the client side and updates the user interface efficiently without requiring full page reloads. It can work together with other tools and frameworks, such as Next.js. Today, React is widely used in both small-scale and large-scale web applications.

Incident:

  Widespread attacks have been detected targeting applications developed with React 19 and Next.js, particularly systems that have React Server Components (RSC) enabled. This vulnerability has been classified with the highest severity level (Critical), with details as follows:

  The vulnerability CVE-2025-55182 (React2Shell) originates from a flaw in the React Flight protocol, which is responsible for handling the serialization and deserialization of objects between the server and client. The core issue lies in insufficient type validation performed by the server-side parser during the deserialization process. As a result, an attacker can send a crafted HTTP POST request containing a malicious object with embedded system commands. When the server processes this payload, it can immediately lead to remote code execution (RCE) without requiring any authentication (pre-authentication).

  Based on threat intelligence monitoring, this vulnerability has been actively exploited in the wild by malicious actors across multiple attack scenarios, as detailed below.

  APT groups and cybercriminals have leveraged this vulnerability as an initial access vector to deploy EtherRAT malware, enabling remote system control and command execution. The attackers further expanded their access laterally across the internal network to reach critical systems and sensitive databases within the organization.

  Cloud system attacks have been observed involving attempts to read environment variables in order to steal cloud access keys (such as AWS, Azure, and GCP credentials), posing a high risk of large-scale compromise and takeover of the organization’s cloud infrastructure.

  Cryptocurrency mining malware deployment has been observed, where automated scripts scan for vulnerable servers and install XMRig (cryptominer), resulting in excessive consumption of server resources and degradation of overall system performance.

Recommendation:

  -  Verify and immediately update affected libraries to patched versions(React 19.0.3+,

      Next.js 15.0.7+).

  -  Configure a Web Application Firewall (WAF) with rules to detect and block abnormal HTTP      requests, particularly malformed payloads in the request body targeting the RSC protocol.         

  -  Monitor and investigate processes exhibiting abnormal resource consumption, such as           sustained high CPU usage.

  - Scan systems for Indicators of Compromise (IoCs) associated with EtherRAT and XMRig.

  - Remove any unauthorized files or suspicious scheduled tasks from affected systems.

The important things is Security systems. We must concern and monitor as usual.
For more information please contact
Email :sales@inetms.co.th
065 149 2822 (Ms.Suphatson )
063 204 4534 (Ms.Atsamaphorn)
065 929 6330 (Ms.Kansinee)
061 387 9439 (Ms.Sirilak)
092 257 6902 (Ms.Narusorn)
063 197 7510 (Mr.Yanotai)
065 725 7405 (Ms.Nattharini)

References :

          - https://www.microsoft.com/en-us/security/blog/2025/12/15/defending-against-the-cve-2025-     55182-react2shell-vulnerability-in-react-server-components/         

           -   https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-  components

Weekly Interesting CVE

Malware News or Campaign IOC/IOA | EN

Ref: https://www.bleepingcomputer.com/news/security/cybervolks-ransomware-debut-stumbles-on-cryptography-weakness/ ​