Full Report
A security incident involving React was reported in December 2025. See incident details, impact on customers, and recommended security measures.
Analysis Summary
# Incident Report: Critical React2Shell RCE Exploitation
## Executive Summary
In December 2025, a critical Remote Code Execution (RCE) vulnerability, known as "React2Shell" (CVE-2025-55182), affecting React Server Components via the "Flight" protocol, was actively exploited by multiple threat groups, including Earth Lamia, Jackpot Panda, and UNC5174. The flaw, assigned a CVSS score of 10.0, allowed unauthenticated attackers to execute arbitrary server commands, leading to confirmed compromises across at least 30 organizations shortly after its disclosure and inclusion in the CISA KEV catalog.
## Incident Details
- **Discovery Date:** On or before December 6, 2025 (Date CISA added to KEV catalog).
- **Incident Date:** Began days prior to December 6, 2025.
- **Affected Organization:** Organizations utilizing vulnerable versions of React Server Components (react.dev context provided).
- **Sector:** Not explicitly limited (attacks observed across multiple sectors, including those targeted by APTs).
- **Geography:** Global (as implied by involvement of global APT groups and CISA cataloging).
## Timeline of Events
### Initial Access
- **Date/Time:** Prior to December 6, 2025.
- **Vector:** Insecure Deserialization in the "Flight" protocol used by React Server Components.
- **Details:** Attackers sent specially crafted HTTP requests targeting the vulnerability.
### Lateral Movement
- *Details not explicitly provided in the text, but implied by RCE leading to potential full server compromise.*
### Data Exfiltration/Impact
- **Impact:** Confirmed exploitation leading to the execution of arbitrary commands, posing an immediate risk of full server compromise for unpatched systems. Over 30 organizations were confirmed affected by Palo Alto Networks Unit 42.
### Detection & Response
- **Detection:** Confirmed active exploitation reports led CISA to add the flaw to its KEV catalog on December 6, 2025. Amazon reportedly identified attacks linked to Chinese state-nexus groups within hours of disclosure.
- **Response Actions:** CISA cataloged the vulnerability, signaling high priority for remediation across government and critical infrastructure.
## Attack Methodology
- **Initial Access:** Remote Code Execution (RCE) via specially crafted HTTP requests targeting the "Flight" protocol deserialization flaw.
- **Persistence:** *Not specified.*
- **Privilege Escalation:** *Not specified, but RCE implies high initial access.*
- **Defense Evasion:** *Not specified.*
- **Credential Access:** *Not specified as a primary vector, but potential outcome.*
- **Discovery:** *Not specified.*
- **Lateral Movement:** *Not specified.*
- **Collection:** *Not specified.*
- **Exfiltration:** *Potentially occurred, but not detailed.*
- **Impact:** Arbitrary command execution on affected servers.
## Impact Assessment
- **Financial:** Estimated costs not available.
- **Data Breach:** Data type/volume unknown, but the exploit allows for full server compromise, indicating a high risk of sensitive data theft.
- **Operational:** Significant risk of service disruption due to full server compromise if systems run vulnerable React instances.
- **Reputational:** High impact due to the criticality of the vulnerability (CVSS 10.0) and confirmed exploitation by multiple nation-state-linked groups.
## Indicators of Compromise
- **Network Indicators:** Specially crafted HTTP requests targeting the React "Flight" protocol endpoint (Defanged: `hxxp://[target_server]`).
- **File Indicators:** *Not specified.*
- **Behavioral Indicators:** Unauthorized remote command execution on application servers hosting React components.
## Response Actions
- **Containment:** Focus on identifying and isolating all systems running the vulnerable version of React Server Components.
- **Eradication:** Immediate patching to mitigate CVE-2025-55182.
- **Recovery:** Validating system integrity post-patching to ensure no backdoors or secondary persistence mechanisms were established by actors such as UNC5174.
## Lessons Learned
- Insecure deserialization in core application protocols (like React's "Flight") presents an extremely high-risk path for unauthenticated RCE.
- State-nexus actors (Earth Lamia, Jackpot Panda, UNC5174) move rapidly to exploit zero-day flaws upon public disclosure, demanding near-immediate patching.
## Recommendations
- Immediately upgrade all deployments leveraging React Server Components to versions mitigating **CVE-2025-55182**.
- Implement strict ingress filtering and WAF rules specifically looking for known patterns associated with deserialization exploits until patching is complete.
- Continuous threat monitoring for suspicious remote command execution originating from web application servers.