{"id":259,"date":"2026-03-16T08:31:07","date_gmt":"2026-03-16T08:31:07","guid":{"rendered":"https:\/\/jasveermaan.com\/?p=259"},"modified":"2026-05-08T02:42:36","modified_gmt":"2026-05-08T02:42:36","slug":"exploiting-react-server-components-rce-react2shell-cve-2025-55182","status":"publish","type":"post","link":"https:\/\/jasveermaan.com\/index.php\/2026\/03\/16\/exploiting-react-server-components-rce-react2shell-cve-2025-55182\/","title":{"rendered":"Exploiting React Server Components RCE (React2Shell \u2013 CVE-2025-55182)"},"content":{"rendered":"\n<p>Modern web applications increasingly rely on frameworks such as React and Next.js to build dynamic user interfaces. While these frameworks provide powerful features for developers, they also introduce new attack surfaces that security professionals must understand.<\/p>\n\n\n\n<p>One of the most critical vulnerabilities discovered in recent years is React2Shell, tracked as CVE-2025-55182. This vulnerability affects React Server Components (RSC) and allows attackers to achieve remote code execution (RCE) on affected servers.<\/p>\n\n\n\n<p>In this post, I will walk through how I identified and exploited this vulnerability during a security assessment.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Understanding React Server Components<\/h2>\n\n\n\n<p>React Server Components allow parts of a React application to be rendered directly on the server instead of the client. This improves performance and enables better data handling.<\/p>\n\n\n\n<p>React uses a protocol called React Flight to serialize component data between the server and the browser.<\/p>\n\n\n\n<p>However, the vulnerability arises because the server deserializes data received from HTTP requests without sufficiently validating the structure. Under certain conditions, specially crafted payloads can manipulate the deserialization process and lead to arbitrary code execution<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What is CVE-2025-55182 (React2Shell)<\/h2>\n\n\n\n<p>CVE-2025-55182 is a critical unauthenticated remote code execution vulnerability in React Server Components. The issue exists due to unsafe deserialization of data within the React Flight protocol.<\/p>\n\n\n\n<p>An attacker can send a malicious HTTP request that manipulates the serialized component payload. When the server processes this payload, arbitrary JavaScript code can be executed.<\/p>\n\n\n\n<p>Because React applications often run on Node.js servers, this can ultimately lead to operating system command execution.<\/p>\n\n\n\n<p>The vulnerability has been assigned a CVSS score of 10.0, the maximum severity rating<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Identifying React Server Components<\/h2>\n\n\n\n<p>While testing the application, I first verified that React Server Components were being used. The server response contained serialized React component data such as:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">\"$Sreact.fragment\"<\/pre>\n\n\n\n<p>This indicator confirms that the application is returning React Flight responses, meaning that the server processes serialized component data.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Crafting a Malicious React Payload<br><\/h2>\n\n\n\n<p>Once the presence of React Server Components was confirmed, the next step was to craft a malicious HTTP request targeting the server\u2019s component deserialization process.<\/p>\n\n\n\n<p>The request sends a specially crafted multipart payload that abuses the React serialization mechanism and invokes the Node.js runtime.<\/p>\n\n\n\n<p>Example HTTP request:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"626\" height=\"469\" src=\"https:\/\/jasveermaan.com\/wp-content\/uploads\/2026\/03\/SampleRCERequest.png\" alt=\"\" class=\"wp-image-262\"\/><\/figure>\n\n\n\n<p>The injected payload executes the following Node.js code:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">process.mainModule.require('child_process').execSync('id')<\/pre>\n\n\n\n<p>This command forces the server to execute the operating system id command.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Verifying Command Execution<\/h2>\n\n\n\n<p>When the malicious payload is successfully processed, the server executes the injected command and returns the output encoded in Base64 within the response header.<\/p>\n\n\n\n<p>An example response header is shown below:.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">X-Action-Redirect: \/login?a=dWlkPTEwMSBnaWQ9MChyb290KSBncm91cHM9MChyb290KSwxMDEK;push<\/pre>\n\n\n\n<p>Decoding the Base64 value reveals the output of the executed command:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">uid=101 gid=0(root) groups=0(root),101<\/pre>\n\n\n\n<p>This confirms that the injected command was successfully executed on the server. The figure below illustrates the full HTTP request and response demonstrating successful remote command execution.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1557\" height=\"543\" src=\"https:\/\/jasveermaan.com\/wp-content\/uploads\/2026\/03\/Burp_RCE1.png\" alt=\"\" class=\"wp-image-264\"\/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Accessing Sensitive Files<\/h2>\n\n\n\n<p>To further demonstrate the impact, the payload was modified to retrieve the contents of sensitive system files. The following command was executed:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">cat \/etc\/passwd<\/pre>\n\n\n\n<p>The server returned the contents of the file, confirming that arbitrary file access is possible through the vulnerability.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1554\" height=\"589\" src=\"https:\/\/jasveermaan.com\/wp-content\/uploads\/2026\/03\/Burp_RCE2.png\" alt=\"\" class=\"wp-image-265\"\/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Impact<\/h2>\n\n\n\n<p>Successful exploitation allows attackers to:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Execute arbitrary commands on the server<\/li>\n\n\n\n<li>Access sensitive files<\/li>\n\n\n\n<li>Modify application data<\/li>\n\n\n\n<li>Install malware or backdoors<\/li>\n\n\n\n<li>ivot to internal infrastructure<\/li>\n<\/ul>\n\n\n\n<p>Because this vulnerability requires no authentication, it represents a severe risk to exposed React Server Component applications.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Mitigation<\/h2>\n\n\n\n<p>Developers should immediately take the following actions:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Upgrade React<\/li>\n<\/ol>\n\n\n\n<p>Upgrade React and related packages to patched versions:<\/p>\n\n\n\n<p>React 19.0.1<br>React 19.1.2<br>React 19.2.1<\/p>\n\n\n\n<ol start=\"2\" class=\"wp-block-list\">\n<li>Restrict RSC Endpoints<\/li>\n<\/ol>\n\n\n\n<p>Ensure that React Server Component endpoints are not directly accessible from external clients.<\/p>\n\n\n\n<ol start=\"3\" class=\"wp-block-list\">\n<li>Validate Incoming Requests<\/li>\n<\/ol>\n\n\n\n<p>Reject malformed React Flight payloads and enforce strict schema validation.<\/p>\n\n\n\n<ol start=\"4\" class=\"wp-block-list\">\n<li>Monitor for Exploitation<\/li>\n<\/ol>\n\n\n\n<p>Monitor logs for suspicious multipart requests or unusual React Flight payload structures.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Final Thoughts<\/h2>\n\n\n\n<p>React2Shell highlights an important lesson: modern frameworks introduce new attack surfaces that traditional security testing may miss.<\/p>\n\n\n\n<p>With the increasing adoption of server-side rendering frameworks, understanding the internals of protocols such as React Flight is becoming essential for security professionals.<\/p>\n\n\n\n<p>If your organization runs React Server Components, patching this vulnerability should be treated as an immediate priority.<\/p>\n\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Modern web applications increasingly rely on frameworks such as React and Next.js to build dynamic user interfaces. While these frameworks provide powerful features for developers, they also introduce new attack surfaces that security professionals must understand. One of the most critical vulnerabilities discovered in recent years is React2Shell, tracked as CVE-2025-55182. This vulnerability affects React &hellip; <\/p>\n<p class=\"link-more\"><a href=\"https:\/\/jasveermaan.com\/index.php\/2026\/03\/16\/exploiting-react-server-components-rce-react2shell-cve-2025-55182\/\" class=\"more-link\">Continue reading<span class=\"screen-reader-text\"> &#8220;Exploiting React Server Components RCE (React2Shell \u2013 CVE-2025-55182)&#8221;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-259","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/jasveermaan.com\/index.php\/wp-json\/wp\/v2\/posts\/259","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/jasveermaan.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/jasveermaan.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/jasveermaan.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/jasveermaan.com\/index.php\/wp-json\/wp\/v2\/comments?post=259"}],"version-history":[{"count":4,"href":"https:\/\/jasveermaan.com\/index.php\/wp-json\/wp\/v2\/posts\/259\/revisions"}],"predecessor-version":[{"id":266,"href":"https:\/\/jasveermaan.com\/index.php\/wp-json\/wp\/v2\/posts\/259\/revisions\/266"}],"wp:attachment":[{"href":"https:\/\/jasveermaan.com\/index.php\/wp-json\/wp\/v2\/media?parent=259"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/jasveermaan.com\/index.php\/wp-json\/wp\/v2\/categories?post=259"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/jasveermaan.com\/index.php\/wp-json\/wp\/v2\/tags?post=259"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}