Meta React Server Components远程代码执行漏洞(React2Shell)

详细信息

漏洞类型

通用型漏洞

漏洞描述

React Server Components 19.0.0、19.1.0、19.1.1和19.2.0版本中存在预认证远程代码执行漏洞，包括以下包：react-server-dom-parcel、react-server-dom-turbopack和react-server-dom-webpack。漏洞源于解析客户端提交的表单时缺少安全校验，易受攻击的代码不安全地将来自HTTP请求到服务器功能端点的负载进行反序列化。攻击者可利用该漏洞构造恶意表单请求，在服务器上执行任意系统命令、读写任意文件，甚至完全接管服务。部分依赖React的框架和打包工具存在漏洞，包括：next.js、react-router、Expo、waku、@parcel/rsc、@vitejs/plugin-rsc以及rwsdk。React安全团队指出，即使没有使用React Server Functions，只要应用程序支持React服务器组件，该漏洞仍然可以被利用。Next.js团队发布的CVE-2025-66478（编号已被拒绝）与此漏洞重复。

修复建议

1、React Server Components升级到19.0.1、19.1.2、19.2.1或更高版本，参考链接： https://github.com/facebook/react/releases/tag/v19.0.1 https://github.com/facebook/react/releases/tag/v19.1.2 https://github.com/facebook/react/releases/tag/v19.2.1 2、其它受影响的React框架和打包工具参考React发布的升级指南，参考链接： https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components

参考链接

• http://www.openwall.com/lists/oss-security/2025/12/03/4

  OSV · Mailing List · Patch · Third Party Advisory

• https://github.com/facebook/react

  OSV

• https://github.com/facebook/react/commit/7dc903cd29dac55efb4424853fd0442fef3a8700

  OSV

• https://github.com/facebook/react/pull/35277

  OSV

• https://github.com/facebook/react/releases/tag/v19.0.1

  OSV

• https://github.com/facebook/react/releases/tag/v19.1.2

  OSV

• https://github.com/facebook/react/releases/tag/v19.2.1

  OSV

• https://github.com/facebook/react/security/advisories/GHSA-fv66-9v8q-g76r

  OSV

• https://github.com/vitejs/vite-plugin-react

  OSV

• https://github.com/vitejs/vite-plugin-react/security/advisories/GHSA-fmh4-wr37-44fp

  OSV

• https://nvd.nist.gov/vuln/detail/CVE-2025-55182

  OSV

• https://osv.dev/vulnerability/GHSA-fmh4-wr37-44fp

  OSV

• https://osv.dev/vulnerability/GHSA-fv66-9v8q-g76r

  OSV

• https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components

  CVE · x_refsource_CONFIRM

• https://www.facebook.com/security/advisories/cve-2025-55182

  CVE · x_refsource_CONFIRM

• https://github.com/advisories/GHSA-fv66-9v8q-g76r

  GitHub

• https://news.ycombinator.com/item?id=46136026

  OSV · Issue Tracking

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-55182

  OSV · US Government Resource

• https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/

  OSV · Third Party Advisory

• https://osv.dev/vulnerability/CVE-2025-55182

  OSV

• https://github.com/ejpir/CVE-2025-55182-poc

  OSV

• https://github.com/likec4/likec4/security/advisories/GHSA-vr6p-vq2p-6j74

  OSV

• https://github.com/likec4/likec4

  OSV

• https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components

  OSV

• https://osv.dev/vulnerability/GHSA-vr6p-vq2p-6j74

  OSV