Skip to content

Commit 0570493

Browse files
terrancedejesustradebot-elastic
terrancedejesus
authored and
tradebot-elastic
committed
[New Rule] React2Shell Detection (#5408)
* [New Rule] BBR - Potential React.JS CVE-2025-55182 Exploit Attempt Fixes #5406 * updated descriptions * changed to EQL * adjusted note * Update rules_building_block/initial_access_react_server_components_rce_attempt.toml Co-authored-by: Samirbous <[email protected]> * adjusted query * adding anomalous RSC BBR rule; adusted query to be react2shell RCE specific * updated BBR * removed BBR react2shell rule * adjusted regex to not be proto focused * Update rules/network/initial_access_react_server_components_rce_attempt.toml Co-authored-by: Mika Ayenson, PhD <[email protected]> * adjusted query * removed constructor requirement --------- Co-authored-by: Samirbous <[email protected]> Co-authored-by: Mika Ayenson, PhD <[email protected]> (cherry picked from commit 0b94991)
1 parent 66fa81a commit 0570493

File tree

2 files changed

+240
-0
lines changed

2 files changed

+240
-0
lines changed

‎rules/network/initial_access_react_server_components_rce_attempt.toml‎

Lines changed: 123 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,123 @@
1+
[metadata]
2+
creation_date = "2025/12/04"
3+
integration = ["network_traffic"]
4+
maturity = "production"
5+
updated_date = "2025/12/05"
6+
7+
[rule]
8+
author = ["Elastic"]
9+
description = """
10+
This rule detects exploitation attempts targeting CVE-2025-55182, a critical remote code execution vulnerability in
11+
React Server Components (RSC) Flight protocol. The vulnerability allows attackers to execute arbitrary code on the
12+
server by sending specially crafted deserialization payloads that exploit prototype chain traversal to access the
13+
Function constructor. This rule focuses on high-fidelity indicators of active exploitation including successful command
14+
execution responses and prototype pollution attack patterns.
15+
"""
16+
from = "now-9m"
17+
index = ["logs-network_traffic.http*"]
18+
language = "eql"
19+
license = "Elastic License v2"
20+
name = "React2Shell (CVE-2025-55182) Exploitation Attempt"
21+
note = """## Triage and analysis
22+
23+
### Investigating React2Shell (CVE-2025-55182) Exploitation Attempt
24+
25+
This rule detects exploitation attempts targeting CVE-2025-55182, a critical remote code execution vulnerability in React's Flight protocol used by Next.js and other RSC implementations. The vulnerability stems from insecure prototype chain traversal in the Flight deserializer, allowing attackers to access `__proto__`, `constructor`, and ultimately the `Function` constructor to execute arbitrary code.
26+
27+
### Possible investigation steps
28+
29+
- Examine the full HTTP request body to identify the specific attack payload and command being executed.
30+
- Check the response body for `E{"digest":"..."}` patterns which contain command output from successful exploitation.
31+
- Identify the target application and verify if it runs vulnerable React (< 19.1.0) or Next.js (< 15.3.2) versions.
32+
- Review the source IP for other reconnaissance or exploitation attempts against web applications.
33+
- Check for the `Next-Action` header which is required for the exploit to work.
34+
- Correlate with process execution logs to identify if child processes (e.g., shell commands) were spawned by the Node.js process.
35+
36+
### False positive analysis
37+
38+
- Legitimate React Server Components traffic will NOT contain `__proto__`, `constructor:constructor`, or code execution patterns.
39+
- Security scanning tools like react2shell-scanner may trigger this rule during authorized penetration testing.
40+
- The combination of prototype pollution patterns with RSC-specific syntax is highly indicative of malicious activity.
41+
42+
### Response and remediation
43+
44+
- Immediately update affected applications: React >= 19.1.0, Next.js >= 15.3.2.
45+
- Block the source IP at the WAF/reverse proxy if exploitation is confirmed.
46+
- If HTTP 500 or 303 responses with `digest` output were observed, assume successful code execution and investigate for compromise.
47+
- Review server logs for evidence of command execution (file creation, network connections, process spawning).
48+
- Implement WAF rules to block requests containing `__proto__` or `constructor:constructor` in POST bodies.
49+
"""
50+
references = [
51+
"https://www.wiz.io/blog/critical-vulnerability-in-react-cve-2025-55182",
52+
"https://github.com/assetnote/react2shell-scanner",
53+
"https://slcyber.io/research-center/high-fidelity-detection-mechanism-for-rsc-next-js-rce-cve-2025-55182-cve-2025-66478/",
54+
"https://github.com/msanft/CVE-2025-55182",
55+
]
56+
risk_score = 73
57+
rule_id = "a8f7e9d4-3b2c-4d5e-8f1a-6c9b0e2d4a7f"
58+
severity = "high"
59+
tags = [
60+
"Domain: Network",
61+
"Domain: Application",
62+
"Domain: Web",
63+
"Use Case: Threat Detection",
64+
"Use Case: Vulnerability",
65+
"Tactic: Initial Access",
66+
"Tactic: Execution",
67+
"Data Source: Network Packet Capture",
68+
"Resources: Investigation Guide",
69+
]
70+
timestamp_override = "event.ingested"
71+
type = "eql"
72+
73+
query = '''
74+
network where http.request.method == "POST" and
75+
(
76+
// Successful CVE-2025-55182 RCE - command output in digest
77+
(
78+
http.response.status_code in (500, 303) and
79+
http.response.body.content like~ "*E{\"digest\"*" and
80+
http.request.body.content regex~ """.*\$[0-9]+:[a-zA-Z_0-9]+:[a-zA-Z_0-9]+.*"""
81+
) or
82+
// Prototype pollution attempts in RSC Flight data (never legitimate)
83+
(
84+
http.request.body.content regex~ """.*\$[0-9]+:[a-zA-Z_0-9]+:[a-zA-Z_0-9]+.*""" and
85+
(
86+
http.request.body.content like~ "*__proto__*" or
87+
http.request.body.content like~ "*prototype*"
88+
)
89+
)
90+
)
91+
'''
92+
93+
94+
[[rule.threat]]
95+
framework = "MITRE ATT&CK"
96+
[[rule.threat.technique]]
97+
id = "T1190"
98+
name = "Exploit Public-Facing Application"
99+
reference = "https://attack.mitre.org/techniques/T1190/"
100+
101+
102+
[rule.threat.tactic]
103+
id = "TA0001"
104+
name = "Initial Access"
105+
reference = "https://attack.mitre.org/tactics/TA0001/"
106+
[[rule.threat]]
107+
framework = "MITRE ATT&CK"
108+
[[rule.threat.technique]]
109+
id = "T1059"
110+
name = "Command and Scripting Interpreter"
111+
reference = "https://attack.mitre.org/techniques/T1059/"
112+
[[rule.threat.technique.subtechnique]]
113+
id = "T1059.007"
114+
name = "JavaScript"
115+
reference = "https://attack.mitre.org/techniques/T1059/007/"
116+
117+
118+
119+
[rule.threat.tactic]
120+
id = "TA0002"
121+
name = "Execution"
122+
reference = "https://attack.mitre.org/tactics/TA0002/"
123+

‎rules_building_block/initial_access_anomalous_rsc_flight_data_patterns.toml‎

Lines changed: 117 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,117 @@
1+
[metadata]
2+
creation_date = "2025/12/05"
3+
integration = ["network_traffic"]
4+
maturity = "production"
5+
updated_date = "2025/12/05"
6+
7+
[rule]
8+
author = ["Elastic"]
9+
building_block_type = "default"
10+
description = """
11+
This rule detects anomalous patterns in React Server Components (RSC) Flight protocol data streams that may indicate
12+
code injection or exploitation attempts. The Flight protocol is used by React and Next.js for server-client
13+
communication, and should never contain Node.js code execution primitives like child_process, fs module calls, or eval
14+
patterns. This building block rule casts a wider net to identify suspicious payloads that warrant further investigation.
15+
"""
16+
from = "now-119m"
17+
index = ["logs-network_traffic.http*"]
18+
interval = "60m"
19+
language = "eql"
20+
license = "Elastic License v2"
21+
name = "Anomalous React Server Components Flight Data Patterns"
22+
references = [
23+
"https://react.dev/reference/rsc/server-components",
24+
"https://github.com/facebook/react/blob/main/packages/react-server/src/ReactFlightServer.js",
25+
"https://www.wiz.io/blog/critical-vulnerability-in-react-cve-2025-55182",
26+
"https://slcyber.io/research-center/high-fidelity-detection-mechanism-for-rsc-next-js-rce-cve-2025-55182-cve-2025-66478/",
27+
"https://nextjs.org/docs/app/building-your-application/rendering/server-components",
28+
"https://tonyalicea.dev/blog/understanding-react-server-components/",
29+
]
30+
risk_score = 21
31+
rule_id = "b9c8d7e6-5a4f-3c2b-1d0e-9f8a7b6c5d4e"
32+
severity = "low"
33+
tags = [
34+
"Domain: Network",
35+
"Domain: Application",
36+
"Domain: Web",
37+
"Use Case: Threat Detection",
38+
"Tactic: Initial Access",
39+
"Tactic: Execution",
40+
"Data Source: Network Packet Capture",
41+
"Rule Type: BBR",
42+
]
43+
timestamp_override = "event.ingested"
44+
type = "eql"
45+
46+
query = '''
47+
network where http.request.method == "POST" and http.response.status_code != 200 and
48+
(
49+
// Node.js child_process module
50+
(
51+
http.request.body.content like~ "*require('child_process')*" or
52+
http.request.body.content like~ "*require(\"child_process\")*" or
53+
http.request.body.content like~ "*child_process*" and http.request.body.content like~ "*.exec*"
54+
) or
55+
// Node.js synchronous execution methods
56+
(
57+
http.request.body.content like~ "*.execSync(*" or
58+
http.request.body.content like~ "*.spawnSync(*" or
59+
http.request.body.content like~ "*.execFileSync(*"
60+
) or
61+
// Node.js file system operations - suspicious in RSC context
62+
(
63+
http.request.body.content like~ "*require('fs')*" or
64+
http.request.body.content like~ "*require(\"fs\")*" or
65+
http.request.body.content like~ "*.readFileSync(*" or
66+
http.request.body.content like~ "*.writeFileSync(*" or
67+
http.request.body.content like~ "*.unlinkSync(*"
68+
) or
69+
// Process and module access patterns used in exploitation
70+
(
71+
http.request.body.content like~ "*process.mainModule*" or
72+
http.request.body.content like~ "*process.binding*" or
73+
http.request.body.content like~ "*process.dlopen*"
74+
) or
75+
// JavaScript code execution primitives
76+
(
77+
http.request.body.content like~ "*eval(*" and http.request.body.content like~ "*require*" or
78+
http.request.body.content like~ "*Function(*" and http.request.body.content like~ "*return*"
79+
) or
80+
// Generic prototype pollution indicators
81+
(
82+
http.request.body.content like~ "*prototype*" and http.request.body.content like~ "*constructor*"
83+
)
84+
)
85+
'''
86+
87+
88+
[[rule.threat]]
89+
framework = "MITRE ATT&CK"
90+
[[rule.threat.technique]]
91+
id = "T1190"
92+
name = "Exploit Public-Facing Application"
93+
reference = "https://attack.mitre.org/techniques/T1190/"
94+
95+
96+
[rule.threat.tactic]
97+
id = "TA0001"
98+
name = "Initial Access"
99+
reference = "https://attack.mitre.org/tactics/TA0001/"
100+
[[rule.threat]]
101+
framework = "MITRE ATT&CK"
102+
[[rule.threat.technique]]
103+
id = "T1059"
104+
name = "Command and Scripting Interpreter"
105+
reference = "https://attack.mitre.org/techniques/T1059/"
106+
[[rule.threat.technique.subtechnique]]
107+
id = "T1059.007"
108+
name = "JavaScript"
109+
reference = "https://attack.mitre.org/techniques/T1059/007/"
110+
111+
112+
113+
[rule.threat.tactic]
114+
id = "TA0002"
115+
name = "Execution"
116+
reference = "https://attack.mitre.org/tactics/TA0002/"
117+

0 commit comments

Comments
 (0)