Full Report
Huntress is seeing threat actors exploit React2Shell (CVE-2025-55182) to deploy a Linux backdoor, a reverse proxy tunnel, and a Go-based post-exploitation implant.
Analysis Summary
# Vulnerability: React2Shell (RCE in React Server Components)
## CVE Details
- **CVE ID:** CVE-2025-55182
- **CVSS Score:** 10.0 (Critical)
- **CWE:** CWE-502 (Deserialization of Untrusted Data)
## Affected Systems
- **Products:** React (Server Components) and downstream frameworks.
- **Versions:** All versions of React supporting Server Components prior to the December 2025 patches.
- **Configurations:** Web applications utilizing React Server Components and the React Flight protocol for server-side processing.
## Vulnerability Description
React2Shell is an insecure deserialization vulnerability within the React Flight protocol, which transports server-side components. The flaw allows an unauthenticated attacker to craft a malicious HTTP request that tricks the underlying parsing engine into incorrectly evaluating a payload. This leads to arbitrary code execution on the server hosting the React application.
## Exploitation
- **Status:** Exploited in the wild.
- **Complexity:** Low (requires crafting a single malicious HTTP request).
- **Attack Vector:** Network (Remote, unauthenticated).
## Impact
- **Confidentiality:** High (Full data access possible).
- **Integrity:** High (Attacker can modify system files and application logic).
- **Availability:** High (Attacker can deploy cryptominers or DDoS botnets like Kaiji).
## Remediation
### Patches
- **React:** Upgrade to the latest versions released on or after December 3, 2025.
- **Next.js:** Ensure updates are applied to resolve downstream dependencies (previously tracked as the now-duplicate CVE-2025-66478).
### Workarounds
- No primary workarounds are identified; immediate patching is the only recommended mitigation due to the ease of exploitation.
## Detection
### Indicators of Compromise (IoCs)
- **PeerBlight Backdoor:** A Linux malware family utilizing BitTorrent DHT for command-and-control (C2).
- **CowTunnel:** A reverse proxy tool initiating outbound connections to attacker-controlled FRP (Fast Reverse Proxy) servers.
- **ZinFoq:** A Go-based implant featuring interactive shells, SOCKS5 proxying, and timestomping.
- **Kaiji Botnet:** A variant featuring DDoS capabilities and hardware watchdog abuse.
- **Cryptominers:** Unexpected CPU spikes and unauthorized mining processes.
### Detection Methods
- Monitor for unusual outbound network traffic to known BitTorrent DHT nodes or unrecognized FRP servers.
- Inspect system logs for unexpected interactive shells spawned by web server processes.
- Audit file systems for "timestomped" files or new Go-based binaries in temporary directories.
## References
- **Vendor Advisory:** hxxps[://]react[.]dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components
- **NVD Entry:** hxxps[://]nvd[.]nist[.]gov/vuln/detail/CVE-2025-55182
- **Huntress Blog:** hxxps[://]www[.]huntress[.]com/blog/peerblight-linux-backdoor-exploits-react2shell
- **AWS Security Blog:** hxxps[://]aws[.]amazon[.]com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/