Full transcript
0:00Ladies and gentlemen, boys and girls,
0:02this is it. That's the proof of concept.
0:04This is the exploit. Let me show you.
0:06So, over here in my terminal, I have
0:08just spun up a next app with npm for the
0:12React to shell vulnerability. I'm using
0:14an old version here, 16.0.6,
0:17because this is now patched. But you'll
0:19note, oh, yep, one critical severity
0:22vulnerability. I've spun up the
0:24application. It's running here at
0:25localhost 3000. And in a separate
0:27terminal, let me move into the CVE
0:29folder here. And we do have a proof of
0:32concept.py. And I'll minimize this here.
0:35Make this a smidge smaller so you can
0:37see it. But running the puck, there's
0:39calc. So here's the gist. In case you
0:41missed it, a lot of the internet was
0:43running around like a chicken with their
0:44head cut off because there was a
0:45critical security vulnerability in
0:48React. Not something we tend to have on
0:50our 2025 bingo card. Shout out to you,
0:52Ed. This is an unauthenticated remote
0:55code execution vulnerability and they
0:57recommend upgrading immediately because
0:59this is CVSS 10.0
1:03the highest it goes. Vulnerability is
1:05present in versions 19.0 19.1.0 19.1.1
1:09and 19.2.0 of a lot of the stuff that's
1:12using React server. Now let me say I am
1:15not a front-end guy. I don't do a whole
1:18lot with React or Nex.js JS and I'll be
1:21honest, I don't know much about it. So,
1:23I'm going to be realistically latching
1:25on to the coattails of others here. But,
1:27I thought, you know what? Still, the
1:29fireworks are kind of fun. And I'll
1:31leave, of course, a link to all of this
1:32in the video description because you
1:34will want to update uh all of the
1:36different versions of the software that
1:37you might be using here. Nex.js, React
1:39Router, blah blah blah. But shout out,
1:42kudos, credit where credit is due.
1:44Lachlan Davidson reported this to Meta.
1:47And I don't mean to be making light of
1:48this. Forgive me. I know. Seriously,
1:49genuinely, this is a 10.0 critical
1:52vulnerability, pre-authentication remote
1:55code execution vulnerability in React
1:57server components. So, a whole lot of
1:59the internet could catch on fire. My
2:00buddies over at Whiz are saying almost
2:0240% of cloud environments contain
2:05instances of Nex.js or React that are
2:08vulnerable. Considering just Nex.js, JS
2:10the framework itself is present in
2:12almost 70% of environments and just over
2:1660% of those are public and open to the
2:19internet. So doing the quick math on
2:20that 44% of all cloud environments have
2:24publicly exposed Nex.js instances and I
2:26don't know if you caught it but I had
2:27meant to showcase like a completely
2:29default vanilla flat classic
2:32configuration of just running a Nex.js
2:34JS app with React that's still
2:36vulnerable or was now that this is
2:38patched upgrade. And to be clear, it is
2:40two different vulnerabilities that we're
2:42kind of tracking here. Uh one that I
2:44showed the NVD entry for again was
2:46React, but 66478
2:48is specific to Nex.js. The vulnerability
2:52originates in the upstream React
2:54implementation. That's our 55182
2:57reference, but this advisory with 66478
3:00is the one specific to the app router
3:02use in Nex.js. JS. Again, link in all of
3:05the video description. But let's talk
3:07about the proof of concept because I
3:09think the internet saw a little bit of a
3:10funny boo boo. Haha. He he. Uh, the
3:13other night a lot of folks were
3:14screaming and shouting about this GitHub
3:16repository and that hit the streets
3:18first, but it didn't actually have
3:21working proof of concept code. It wasn't
3:22the actual exploit. So, a little bit
3:25more time passed. People are kind of
3:27wandering, scratching their head,
3:28wondering what the heck this thing's
3:29going to be. But, credit where credit is
3:31due, of course. I saw this from Moritz
3:33Samp and they had shared oh the full rce
3:37remote code execution proof of concept
3:39is now live. They were doing some
3:41analysis and they've got their own
3:42resource and repository here and we
3:44could dig into that. I saw some of the
3:46chatter and conversations online that
3:48followed this and a lot of folks are
3:49saying like look this is it. Yeah, this
3:51is the real one explanation and full rce
3:54proof of concept for the react
3:56vulnerability. This is the proof of
3:58concept that I showcased at the
3:59beginning of the video. And let me try
4:01to walk through this, but please,
4:03please, please let me add the grain of
4:04salt. I don't exactly know all the ins
4:07and outs of this. So, take that for what
4:09it is. But hey, they dive into this.
4:11React offers server functions, which are
4:14basically like RPC or remote procedure
4:16call over HTTP, hypertext transfer
4:19protocol. They fetch data from other
4:22instances to ensure low latency or
4:24perform authenticator requests that the
4:26client doesn't have credentials for.
4:29React does this with the React flight
4:31protocol. Uh and that ends up
4:33serializing or deserializing values.
4:36That's all kind of represented or
4:38wrapped as different chunks. And you can
4:40see a little bit of a logic here to
4:41this. Zero as kind of the first index is
4:44set with some sort of string that looks
4:46like within square braces dollar sign
4:48one to represent some entity, some
4:51abstract object. And then later in the
4:54next entry ID of one here, they add more
4:58structure to that object noting that
5:00it's a fruit with a given property of a
5:02name of a fruit name and that property's
5:05value could be something like cherry.
5:07And then those are referenced. They end
5:10up deserializing data to represent a
5:13fruit object with a given name, cherry.
5:15Of course, it can do a heck of a lot
5:17more, but I think maybe that's enough of
5:19an understanding. The vulnerability ends
5:21up being in how this actually isn't
5:24going to be checked or react itself not
5:27verifying whether or not the key is set
5:30to the object. So you could retrieve the
5:33prototype or a little bit more metadata
5:35fields values kind of inherent and
5:37implicit to that abstract idea. They use
5:40this where they take in that ID or chunk
5:43ID zero dollar sign one but actually
5:45accessing some proto prototype special
5:48dunder function to be able to access
5:50that not function but the constructor
5:52and the constructor to actually access
5:54the initialization function of that
5:57object. Again please let me add the
5:59background context. I don't know if
6:01that's the right or best explanation. Uh
6:04I will leave it to the experts again
6:05with the link in the video description.
6:07But when they start to play with these
6:09because these are all a synchronous with
6:11await and async calls those are thenable
6:14when you have some other opportunities
6:16to have things happen after some data is
6:18processed then you could have it
6:21basically run that function. Well, I
6:24think there is a gimmick there because
6:25you can't as easily call the function,
6:28but you could retrieve the function
6:30constructor. Then you'd want to
6:31eventually run it, execute it, but have
6:34a user controlled value like what you
6:37want to fire and execute. That's not as
6:39easy though. Apparently, I think there
6:41are some other artifacts left over uh
6:43within the language and the way that
6:45would derialize or work with the data. I
6:47guess slice is a function that gets in
6:49the way, but uh big shout out to Maple
6:523142. They had this brilliant idea that
6:54the get chunk capability grabs a chunk
6:57at ID zero, but it could also mean that
7:00it could resolve to a fake chunk, but
7:03not a resolved value. It's raw value.
7:07I'm not going to pretend that I know
7:09everything that's happening here, but uh
7:11that's cool. Ultimately, they end up
7:14with enough staging that they could
7:16craft an object with some vague
7:18properties that the proto and prototype
7:21is actually able to decorate and craft a
7:24chunk which could use some of the more
7:27native natural what we're probably used
7:29to seeing in that CTF or capture the
7:32flag world where we could execute a
7:34actual subprocess and run some system
7:37command process. ual.require child
7:40process and exec sync with whatever you
7:43want to fire off. Maybe it's a reverse
7:45shell. Maybe it's some code. Maybe it's
7:47the calculator as a proof of concept. I
7:49think a lot of folks were laughing, the
7:51folks that know, and forgive me I don't,
7:53that this does feel like a capture the
7:55flag or CTF- like vulnerability. But a
7:58little bit more damning is that that all
8:00happens. all that des serialization work
8:02that's done before the requested action
8:05is even validated in some of the other
8:07functions that are part of the process
8:09here. So even setting a header is enough
8:12to trigger the vulnerability. I believe
8:14that's from React server actions in one
8:16of the old representations or how they
8:18used to call a lot of the react server
8:20components work. So all they end up
8:22doing for the patch is just making a
8:24little silly if statement here. Um hey
8:27are you tracking the proto? [laughter]
8:29Do you know the prototype of everything
8:31in the chunk? Does that exist for
8:32yourself as an object? But look, I don't
8:35want to play pretend that I know
8:37everything that's happening behind the
8:38scenes here. I was the one kind of
8:40sitting with my popcorn waiting to see,
8:41ooh, when's there going to be a pock
8:43drop? Is anybody going to share the
8:44street deets? And again, shout out
8:46Maple. Maple 3142. I saw them share this
8:50video, a proof of concept for the CVE
8:53and a gist that includes the syntax of
8:56at least the request that gets sent
8:59because you'll note they're
9:00experimenting with this in Burpswuite.
9:02They just got uh OBS running to record
9:04this. They've spun up a flat default
9:07React and next app and then they just
9:10click the go button in Burpuite when
9:12that's set to the target to send this
9:14request. Uh, cool. [laughter]
9:18Yeah, yeah, yeah. It's like a fun NodeJS
9:21or whatever server JavaScript runtime
9:23jail challenge that you'd see in a
9:25capture the flag. [laughter]
9:27The gist that they share, of course,
9:28link in the video description. Credit
9:30where credit is due. Uh, it's just the
9:32post request with the prototype crafted
9:36chunk all set there. And they use XCalc
9:38to demonstrate this. But again, remember
9:40like this goes to show how this could
9:42very well be weaponized because like
9:44this is all that you tweak and change to
9:47do anything else to get a reverse shell
9:49connection to run some other malware
9:52virus whatever the heck. Look, I don't
9:54mean to just be adding to the noise with
9:56all this. Uh I think this is going to
9:58probably explode to the sort of log for
10:00shell scenario. So sorry for that PTSD
10:03and trauma. Um, but react to shell
10:06sounds like really what we're going to
10:08end up having for our Thanksgiving 2025.
10:11A lot of folks are going to be doing a
10:12lot of awesome stuff to help track this.
10:14I'll leave of course again links in the
10:16video description where I can for blue
10:18team cheat sheet. Uh, folks will be
10:20sharing different scanners. I know
10:21there'll be honeypotss or oh little
10:23things out and about so we could see
10:24this out on the internet. Interested to
10:26see the showdan census all of the
10:28different assets and inventory things
10:29that we might be able to track. So,
10:31you're probably going to see an absolute
10:33flood of all of these advisories,
10:36reports, releases, tools, scanners, more
10:39proof of concepts, different things to
10:41see this out across the internet. Uh,
10:42but I don't want you to have your head
10:44in the sand here as more proof of
10:46concepts hit the street. Uh, be all out
10:48and about on the internet. Looks like
10:49here's another in Python that could
10:52probably get a full-blown reverse shell.
10:54Yeah. Yeah. Yeah. Here's functionality
10:55for that specific to Linux. It looks
10:57like this is going to blow things up a
10:59little bit again. I think for all you
11:00Versel people, looks like Big G is
11:02sharing the fact that oh, their little
11:04waffy boy will go ahead and lock that
11:06down. That will block the variant. But
11:08patch, upgrade, patch your potatoes,
11:11patch the poop out of it. Uh do what you
11:13got to do.