id: CVE-2025-55182-insikt

info:
  name: CVE-2025-55182 Meta React Server Components (RSC) Remote Code Execution (RCE) Vulnerability
  author: ACHA, Insikt Group, Recorded Future
  severity: critical
  description: |
    Detects vulnerable React Server Components (RSC) packages impacted by CVE-2025-55182 ("React2Shell"), an unauthenticated RCE vulnerability caused by unsafe deserialization of untrusted payloads in Server Function HTTP endpoints. Affects the react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack packages in versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0, as well as frameworks that bundle these packages, including Next.js App Router (15.x and 16.x, and Canary builds starting from 14.3.0-canary.77), React Router, Waku, RedwoodSDK, Parcel, and the Vite RSC plugin when using the vulnerable React packages.
  impact: |
    Remote, unauthenticated attackers can execute arbitrary code, potentially leading to full system compromise.
  remediation: |
    Upgrade the affected React RSC packages to versions 19.0.1, 19.1.2, 19.2.1, or later. For frameworks that bundle these packages, upgrade to a patched release. For Next.js App Router, update to the latest stable patched version (for example, 16.0.7, 15.5.7, 15.4.8, 15.3.6, 15.2.6, 15.1.9, or 15.0.5 or newer).
  reference:
    - https://slcyber.io/research-center/high-fidelity-detection-mechanism-for-rsc-next-js-rce-cve-2025-55182-cve-2025-66478
    - https://github.com/assetnote/react2shell-scanner
    - https://nvd.nist.gov/vuln/detail/cve-2025-55182
    - https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components
    - https://nextjs.org/blog/CVE-2025-66478
    - https://github.com/facebook/react/security/advisories/GHSA-fv66-9v8q-g76r
    - https://github.com/advisories/GHSA-9qr9-h5gf-34mp
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10
    cve-id: CVE-2025-55182
    cwe-id: CWE-502 # Deserialization of Untrusted Data
  metadata:
    verified: true
    max-request: 1
    date: 2025-12-09
    last-updated: 2025-12-09
    unique-rule-id: 62f5aef5-3f9c-4594-9456-f1b02eac4317
    mitre-att&ck:
      - attack.t1595.002 # Active Scanning: Vulnerability Scanning
      - attack.t1190 # Exploit Public-Facing Application
    shodan-query: http.component:"Next.js"
    vendor: Meta
    product: React Server Components (RSC)
  tags: cve,cve2025,kev,rce,react2shell

variables:
  request-id: "{{to_lower(rand_text_alphanumeric(8))}}"
  html-id: "{{rand_text_alphanumeric(21)}}"

http:
  - raw:
      - |
        POST / HTTP/1.1
        Host: {{Hostname}}
        Next-Action: "x"
        X-Nextjs-Request-Id: {{request-id}}
        X-Nextjs-Html-Request-Id: {{html-id}}
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryx8jO2oVc6SWP3Sad

        ------WebKitFormBoundaryx8jO2oVc6SWP3Sad
        Content-Disposition: form-data; name="1"

        {}
        ------WebKitFormBoundaryx8jO2oVc6SWP3Sad
        Content-Disposition: form-data; name="0"

        ["$1:aa:aa"]
        ------WebKitFormBoundaryx8jO2oVc6SWP3Sad--

    matchers-condition: and
    matchers:

      - type: status
        status:
          - 500

      - type: word
        part: body
        words:
          - 'E{"digest"'

      - type: dsl # Excludes Netlify/Vercel hosts whose patched 500 responses with "E{"digest" can mimic the safe-check signal, reducing false positives
        condition: and
        dsl:
          - "!contains(to_lower(header), 'netlify')"
          - "!contains(to_lower(header), 'vercel')"
