Introduction: The recent detection of pre-authentication remote code execution (RCE) probes against web infrastructure highlights an urgent threat targeting modern web frameworks. The flaw, known as React2Shell (CVE-2025-55182), stems from unsafe deserialization in React Server Components (RSC) and affects widely adopted frameworks such as Next.js. When automated threat actors incorporate C2 mechanisms, such as smart-contract-backed botnets, internet-facing application endpoints face persistent scanning and exploitation attempts.

A newly disclosed vulnerability (“react2shell”) affects React RSC packages (react-server-dom-*):19.0.0, 19.1.0, 19.1.1, 19.2.0, and all Next.js App Router 15.x / 16.x (plus canaries ≥14.3.0-canary.77).

An explainer compares Log4Shell, React2Shell, PHP2Shell and Node2Shell, detailing their code-execution flaws, exposure paths, affected components, fixes and…

Introduction: The Recurring Danger Behind Critical Software Vulnerabilities The cybersecurity industry continues to face a recurring problem: seemingly unrelated vulnerabilities can expose millions of systems through a single vulnerable software component. From Log4Shell to React2Shell, PHP2Shell and Node2Shell, attackers repeatedly exploit weaknesses in widely deployed technologies to achieve remote code execution, compromise servers and potentially gain access to sensitive environments.

A technical analysis of CVE-2025-55182, demonstrating how React Server Components deserialization leads to remote code execution.

Reactor is a Linux box running a nuclear reactor monitoring dashboard built on NextJS. I’ll pull the framework and React versions out of the JavaScript chunks served to the browser, and find that the site is vulnerable to React2Shell, a pre-authentication flaw where React Server Components unsafely deserialize data from server function requests, giving remote code execution and a shell. In the application directory I’ll find a SQLite database with password hashes that crack to give the next user. To escalate, I’ll find a monitoring script running as root with the NodeJS inspector listening on localhost, and tunnel to it to run code inside that root process using the Chrome DevTools Protocol. I’ll also show to do the root step using node from the command line, and how it can be done directly from the foothold skipping user.

どういうこと？ thenインジェクション Object.prototype.then = function(resolve, reject) { console.log('thenメソッド生やしてみた'); resolve(true); }; async fu...

_This is a submission for the MLH x DEV Writing Challenge_ Every security researcher has a "Project Graveyard" - a dusty local directory where dormant Proof of Concepts (PoCs), 2 AM exploit scripts, and ephemeral bypasses go to die. For me, that script was a raw, 50-line Python snippet authored in December 2025. A CVSS 10.0 vulnerability (CVE-2025-55182 / React2Shell) had just dropped, exposing a critical unauthenticated Remote Code Execution (RCE) attack vector via unsafe deserialization of the React Flight protocol. My script successfully fingerprinted the vulnerability, but its architecture was archaic: synchronous, entirely ephemeral, and reliant on manual DevTools injection to scan a target DOM. It was a functional PoC, but terrible for actual field reconnaissance. When the **MLH Finish-Up-a-Thon** launched, I decided to pull this script out of the archive and operationalize it. Armed with **GitHub Copilot** as my autonomous platform engineer, I spent 48 hours transforming a brittle terminal script into a highly resilient, event-driven, Manifest V3 Chrome Extension. Here is how we turned digital duct tape into a production-grade vulnerability reconnaissance asset. ## What I Built: The RSC Reconnaissance Engine I engineered the **RSC Fingerprint Detector** , a Manifest V3 (MV3) Chrome extension designed for passive and active telemetry gathering on React Server Components (RSC) and the React2Shell deserialization vulnerability class. To eliminate false positives during target enumeration, the extension deploys a strict, dual-phase heuristic pipeline: * **Passive Reconnaissance (Zero-Touch):** Silently hooks the global execution context (`window.__next_f`), performs script asset introspection (`react-server-dom-webpack`), utilizes DOM attribute scanning (`data-rsc`), and monitors network traffic for specific HTTP response headers (`Vary: RSC`). * **Active Probing:** Fires a cross-origin, asynchronous `fetch` with a crafted `X-RSC-Probe` header payload. It then parses the resulting content-type entropy to extract the exact React Flight protocol signature without triggering target backend alerts. **The Architecture Upgrade:** We migrated from a synchronous, single-vector Python script that lost its execution context on page reload, to a declarative MV3 architecture. The new engine features IndexedDB ACID transactions for persistent telemetry, cross-context Inter-Process Communication (IPC), and DOM isolation via Shadow DOM to prevent CSS cross-contamination. ## Telemetry & Visual Proof **GitHub Repository:** anuththara2007-W/CVE-2025-55182-Exploit-extension There is nothing quite as satisfying as the visual proof of operationalizing a raw exploit script into a deployable tool. December 2025 (The Ephemeral PoC) | May 2026 (The Operationalized Asset) ---|--- | _Raw console execution. Highly manual. Zero state persistence._ | _Isolated UI, real-time threat badges, and active CVE mapping._ ## Partner Technologies: GitHub Copilot as a Cyber-Operations Ally Writing the core heuristic logic for vulnerability detection is the fun part. Wrestling with Chrome’s restrictive Content Security Policies (CSP), isolated execution worlds, and MV3 lifecycle deprecations is the grueling friction that kills side projects. **Without GitHub Copilot, this asset would still be a dormant script.** I didn't just use it for autocomplete; I utilized it as a senior platform architect who understood the Chrome Sandbox limitations intimately. Here is how Copilot acted as an elite force multiplier: **1. Bypassing the Manifest V3 Sandbox Constraints** Background pages are dead in MV3. Copilot flawlessly orchestrated my `manifest.json` schema, registering the Service Worker and migrating my network interception logic to `declarativeNetRequest` instead of the blocking `webRequest` API. It completely bypassed the dreaded "persistent flag" runtime errors that plague MV3 migrations. **2. Bridging the Asynchronous IPC Gap** When setting up `chrome.runtime.sendMessage` across isolated execution contexts (content script to background worker), Copilot automatically injected the mandatory `return true` directive inside the `onMessage` listener. > _The Technical Impact:_ In MV3, failing to return `true` immediately terminates the IPC message channel, causing silent failures for asynchronous callbacks. Copilot patched this race condition before the code even compiled. **3. Architecting Persistent Telemetry** I needed persistent local storage for scan logs but wanted to avoid bloated wrapper libraries. Copilot generated a raw IndexedDB implementation from scratch, engineering the `onupgradeneeded` handler, object store schemas, and timestamp indexing. It proactively wrapped the database transactions in `try/catch` blocks, implementing idempotency and retry logic for transient database lock errors. ### The "Mic-Drop" Network Interception The most impressive moment occurred while configuring the passive packet-sniffing logic. I wrote a single comment: `// Capture RSC responses via webRequest` Copilot instantly synthesized this interception block: chrome.webRequest.onHeadersReceived.addListener( function(details) { const isRSC = details.responseHeaders.some(h => h.name.toLowerCase() === 'content-type' && h.value.includes('text/x-component') ); if (isRSC) { saveFlight(details); // Trigger telemetry extraction } }, { urls: ["<all_urls>"] }, ["responseHeaders"] // <-- Copilot successfully identified this mandatory MV3 bypass! ); Injecting `"responseHeaders"` into the `extraInfoSpec` array is an obscure, critical MV3 security requirement. If omitted, Chrome silently sanitizes the headers from your extension's execution context. Copilot's deep contextual awareness of Chrome's security model saved me hours of debugging silent telemetry drops. ## Hackathon Experience Participating as a Solo Developer in the MLH Finish-Up-a-Thon completely shifted my perspective on software development in the security space. Standard hackathons prioritize reckless velocity-getting a prototype to compile by any means necessary. This event prioritized _craftsmanship and operational readiness_. It forced me to analyze the "last mile" of software engineering: error boundaries, state persistence, UI reactivity, and adhering to strict platform security models. We often abandon security research tools because the friction of engineering a deployable interface outweighs the adrenaline of writing the initial exploit logic. GitHub Copilot eradicated that friction. It handled the exhausting platform boilerplate, allowing me to focus 100% of my cognitive load on the vulnerability architecture. My biggest takeaway? A dead PoC doesn't have to stay in the graveyard. With the right AI tooling and a structured deadline, you can resurrect a forgotten script and weaponize it into a professional-grade asset. _Disclaimer: This reconnaissance tool is intended strictly for authorized vulnerability scanning, threat intelligence, and educational purposes. Use only on infrastructure you own or have explicit, documented authorization to test._

Datadog Security Research identified two unauthenticated credential-harvesting platforms, Loot and UltraVault, that inventory, validate, and operationalize stolen secrets, including AWS and AI service credentials. The activity shows AI-assisted attack workflows, active re-probing of credentials, and exploitation chains tied to vulnerabilities such as react2shell, wp2shell, xss2shell, and joomla2shell. #Datadog #Loot #UltraVault #AmazonBedrock #Anthropic #OpenAI #AWS #CVE-2025-55182 #CVE-2026-63030 #CVE-2026-60137 #CVE-2026-64638 #CVE-2026-48907

The UAT-10608 campaign exploits the React2Shell RCE flaw to harvest sensitive credentials from Next.js apps, compromising 766 hosts globally.