CVE-2025-55182 & CVE-2025-66478 React2Shell – All You Need t...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://jfrog.com/blog/2025-55182-and-2025-66478-react2shell-all-you-need-to-know/
• Blog Title: CVE-2025-55182 & CVE-2025-66478 React2Shell – All You Need to Know
• Suggested Section: network-services-pentesting/pentesting-web/nextjs (or a new subsection under Pentesting Web -> NextJS focused on React Server Components/Functions RCE and react2shell-scanner style detection oracles)

🎯 Content Summary

This post provides a focused technical overview of the critical React/Next.js remote code execution vulnerability known as React2Shell, tracked as CVE-2025-55182 (React) and CVE-2025-66478 (Next.js). The core problem lies in the implementation of React Server Components (RSC) and in particular React Server Functions (RSF): a remote attacker can craft a malicious HTTP request to any React Server Function endpoint which, when deserialized by the vulnerable RSC...

🔧 Technical Details

Exploiting React Server Functions via crafted RSC HTTP payloads
React2Shell shows that any HTTP endpoint backed by a React Server Function (a function containing the 'use server'; directive) becomes an attack surface for the React Server Components (RSC) wire protocol. An attacker does not rely on normal browser form submissions; instead, they manually craft HTTP requests that follow (or abuse) the RSC serialization format and send them directly to these server-function endpoints. In vulnerable RSC implementations, the deserialization process mishandles this untrusted serialized data and can lead to arbitrary code execution on the server. The practical trick for attackers is to first identify RSF endpoints (e.g., by discovering routes of frameworks like Next.js App Router that use app directory server components) and then deliver specialized RSC-formatted payloads as part of POST requests. Although this article does not disclose the low-level RSC...

🤖 Agent Actions

Updated src/network-services-pentesting/pentesting-web/nextjs.md with a comprehensive React2Shell-focused section:

• Added guidance on identifying exposed React Server Functions (RSFs) via 'use server';, App Router fingerprints, and other RSC-enabled frameworks.
• Documented vulnerable vs. fixed versions for react-server-dom-* packages and Next.js releases, plus canary downgrade advice.
• Described remote detection using Assetnote’s react2shell-scanner, including the HTTP 500 + E{"digest" oracle and example commands.
• Provided a mitigation workflow covering inventory, upgrades, canary handling, and temporary fallback to the Pages Router.
• Extended the references list with the JFrog React2Shell blog and the scanner repository.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://jfrog.com/blog/2025-55182-and-2025-66478-react2shell-all-you-need-to-know/

Content Categories: Based on the analysis, this content was categorized under "network-services-pentesting/pentesting-web/nextjs (or a new subsection under Pentesting Web -> NextJS focused on React Server Components/Functions RCE and react2shell-scanner style detection oracles)".

Repository Maintenance:

• MD Files Formatting: 915 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0