Full Report
A security incident involving React was reported in December 2025. See incident details, impact on customers, and recommended security measures.
Analysis Summary
# Incident Report: React2Shell Critical RCE Exploitation
## Executive Summary
In December 2025, a critical Remote Code Execution (RCE) vulnerability, dubbed "React2Shell" (CVE-2025-55182), impacting React Server Components' "Flight" protocol was disclosed and actively exploited. The flaw, rated CVSS 10.0, allowed unauthenticated attackers to execute arbitrary commands via crafted HTTP requests. The incident rapidly involved multiple nation-state-linked threat groups, leading to confirmed compromise of over 30 organizations shortly after disclosure.
## Incident Details
- Discovery Date: December 6, 2025 (CISA KEV addition date)
- Incident Date: Early December 2025 (Confirmed active exploitation)
- Affected Organization: React (react.dev) ecosystem/unpatched servers utilizing vulnerable React Server Components
- Sector: Technology (Widespread impact across all sectors using affected libraries)
- Geography: Global (Attacks reported by Amazon shortly after disclosure)
## Timeline of Events
### Initial Access
- Date/Time: Undetermined, but pre-December 6, 2025
- Vector: Exploitation of **CVE-2025-55182 (React2Shell)**
- Details: Attackers sent specially crafted HTTP requests targeting servers running React Server Components, leveraging insecure deserialization within the "Flight" protocol to achieve RCE.
### Lateral Movement
- Details: Not explicitly detailed in the context, but RCE suggests immediate execution capabilities on the affected server, potentially leading to subsequent network discovery or persistence mechanisms (as employed by associated threat groups like Earth Lamia).
### Data Exfiltration/Impact
- Details: Full server compromise potential due to RCE. Over 30 organizations confirmed affected. Associated threat groups (Earth Lamia, Jackpot Panda) suggest potential espionage or state-sponsored data theft.
### Detection & Response
- Date/Time: Prior to December 6, 2025 (Active exploitation confirmed)
- Details: CISA added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on December 6, 2025, indicating confirmed real-world exploitation. Amazon identified linkage to Chinese state-nexus groups quickly.
## Attack Methodology
- Initial Access: Remote Code Execution (RCE) via specially crafted HTTP requests exploiting insecure deserialization in the React "Flight" protocol.
- Persistence: Not specified, but associated APTs (Earth Lamia) commonly use custom loaders.
- Privilege Escalation: Achieved immediately via the RCE flaw (unauthenticated access leading to command execution).
- Defense Evasion: Exploitation relies on a core protocol flaw, likely bypassing standard application-level security controls initially.
- Credential Access: Not specified, but likely subsequent actions post-RCE.
- Discovery: Not specified, but likely reconnaissance by threat actors prior to or immediately following initial access.
- Lateral Movement: Not specified.
- Collection: Not specified, but typical for threat groups involved (e.g., espionage).
- Exfiltration: Not specified.
- Impact: Full server compromise (as stated by Palo Alto Networks).
## Impact Assessment
- Financial: Unknown, but significant costs associated with incident response and remediation across 30+ organizations.
- Data Breach: High risk of sensitive data compromise due to RCE potential; no specific data type volume disclosed.
- Operational: High operational risk due to confirmed active exploitation leading to potential full server compromise.
- Reputational: Significant reputational risk for the React ecosystem given the severity and involvement of sophisticated threat actors.
## Indicators of Compromise
- Network Indicators: Specially crafted malicious HTTP requests targeting React Flight protocol endpoints (Defanged examples: `http://[Target_IP]:[Port]/_next/static/chunks/react-server-component/...`)
- File Indicators: Custom loaders or backdoors deployed by threat groups Earth Lamia, Jackpot Panda, or UNC5174.
- Behavioral Indicators: Execution of arbitrary commands on web application servers originating from HTTP request handlers.
## Response Actions
- Containment Measures: Immediate patching/mitigation of the CVE-2025-55182 flaw across all affected React deployments.
- Eradication Steps: Forensic analysis to identify specific compromises, removal of any established persistence mechanisms by threat actors.
- Recovery Actions: Restoration of compromised systems from clean backups, hardening configurations to prevent recurrence.
## Lessons Learned
- Insecure deserialization vulnerabilities, especially within high-profile serialization protocols like React's "Flight," carry extreme risk (CVSS 10.0).
- State-nexus threat actors (Earth Lamia, Jackpot Panda) actively monitor and exploit zero-days immediately upon disclosure or even prior to public knowledge.
- Vendor responsiveness and speed from affected organizations are critical when dealing with universally deployed components like React.
## Recommendations
- Immediately apply patches addressing CVE-2025-55182 across all React Server Component implementations.
- Implement strict input validation and sanitization for all serialized data, especially within proprietary application protocols.
- Enhance monitoring specifically for anomalous command execution attempts originating from web request processing logic.
- Isolate and segment critical infrastructure, recognizing that initial access via high-severity application flaws can lead to total system takeover.