Attackers Exploiting React2Shell Vulnerability to Attack IT Sectors
The React2Shell vulnerability, designated as CVE-2025-55182, has been identified as a critical security flaw affecting companies in the insurance, e-commerce, and IT sectors. It exploits the Flight protocol, which manages client-server communication for…
The React2Shell vulnerability, designated as CVE-2025-55182, has been identified as a critical security flaw affecting companies in the insurance, e-commerce, and IT sectors. It exploits the Flight protocol, which manages client-server communication for React Server Components, allowing unauthorized code execution on vulnerable servers.
The vulnerability arises from insecure deserialization, where server-side acceptance of client data lacks proper verification. This has resulted in attacks deploying the XMRig cryptocurrency miner, alongside botnets and remote access tools. Targeted attacks have utilized the RustoBot and Kaiji botnets for Russian entities, while employing CrossC2 implants, Tactical RMM, VShell backdoors, and EtherRAT trojans in other regions.
React2Shell affects versions 19.0, 19.1.0, 19.1.1, and 19.2.0 of React Server Component packages including react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack. Patches are available in versions 19.0.1, 19.1.2, and 19.2.1. However, simply applying patches is insufficient. Organizations are advised to assess their systems for signs of exploitation and post-exploitation activities.
Developers should verify their Next.js versions and dependencies, rebuild projects post-update, and check lock files to ensure removal of vulnerable package versions. It is also advised to limit the use of experimental React Server Components in production environments unless they are covered by current security patches.
The vulnerability arises from insecure deserialization, where server-side acceptance of client data lacks proper verification.
Infection Mechanism and Malware Deployment
The attack commences by exploiting React2Shell to execute commands within compromised containers. Bash scripts downloaded from remote servers deploy malicious payloads. The wocaosinm.sh script downloads architecture-specific ELF executables, implementing the Kaiji botnet for DDoS attacks and establishing persistence through systemd services, crontab tasks, and modified system utilities.
Another method uses the setup2.sh script to install XMRig version 6.24.0. The alive.sh script terminates processes consuming over 40% CPU, excluding XMRig and other whitelisted processes. DNS tunneling via tools like nslookup is utilized for data exfiltration.
The CrossC2 framework payloads for Cobalt Strike employ UPX-packed executables with encrypted configurations, decrypted using AES-128-CBC. The check.sh script saves these payloads as rsyslo, creating a systemd service for persistence and disguising the malware as "Rsyslo AV Agent Service".
The EtherRAT malware establishes persistence through multiple methods including systemd services, XDG Autostart entries, crontab tasks, .bashrc modifications, and .profile alterations. Its command-and-control server address is retrieved from an Ethereum smart contract, circumventing traditional blocking methods.
Based on reporting by Cyber Security News.