Wiz Details React2Shell Exploitation, Credential Theft and Backdoors in Cloud Workloads
Summary
Wiz describes in-the-wild exploitation of React’s CVE-2025-55182, including credential harvesting, cryptomining and Sliver backdoors in cloud workloads, and explains the exploit mechanics and exposure beyond Next.js.
Key points
- Wiz reports attackers exploiting CVE-2025-55182 for interactive access to internet-facing Next.js applications and other containerized workloads.
- Observed activity includes reconnaissance, cloud and developer credential harvesting, and attempts to access instance metadata for IAM credentials.
- Campaigns deployed XMRig miners, while at least one used Sliver implants for persistent access.
- A reported Node.js payload hooks HTTP request handling to provide a hidden command-execution path; other Node-native payloads harvested files and exfiltrated data without spawning child processes.
- Wiz says the vulnerable React Server Components flow also affects Waku and Vite with RSC plugins; custom React servers may be exposed when they use the vulnerable decoder.
- The article explains how crafted deserialization references and a Function() gadget trigger remote code execution.
Article Details
- Attack Vectors
- Attackers exploit CVE-2025-55182 through crafted React Server Components payloads that abuse improper input deserialization to achieve remote code execution. Next.js applications expose the vulnerable flow by default; the article also reports successful exploitation of Waku and Vite with the RSC Plugin.
- After obtaining code execution in application containers, attackers use interactive reverse shells, DNS callbacks, and shell commands to discover the environment and harvest cloud, developer, and application credentials.
- Observed post-exploitation includes deploying cryptominers and Sliver backdoors, and using a Node.js in-memory webshell or Node-native code to steal files and exfiltrate data.
- Defensive Notes
- Patch vulnerable React Server Components packages and assess exposure across Next.js, Waku, Vite with the RSC Plugin, and custom React servers that invoke the vulnerable decoder.
- Use dynamic scanning and code or disk validation to identify vulnerable packages, including in less common platforms and native React implementations.
- Investigate unexpected shells, DNS callbacks, access to cloud instance metadata, credential-file collection, mining activity, Sliver implants, and anomalous HTTP requests to /favicon.login.ico.
- Review Node.js application processes for runtime tampering, including changes to http.Server.prototype.emit, and monitor for data exfiltration that occurs without spawning child processes.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | anywherehost[.]site | Malware infrastructure used to distribute scripts and miner payloads across multiple customers and clusters. |
| DOMAIN | aws[.]orgserv[.]dnsnet[.]cloud[.]anondns[.]net | Loader infrastructure identified in the IOC list. |
| DOMAIN | ax29g9q123[.]anondns[.]net | Loader infrastructure identified in the IOC list. |
| DOMAIN | inerna1[.]site | Malware infrastructure used to distribute scripts and miner payloads across multiple customers and clusters. |
| DOMAIN | ip[.]inovanet[.]pt | Malware infrastructure hosting a miner payload. |
| DOMAIN | keep[.]camdvr[.]org | Sliver infrastructure used to deliver payloads and a dropper. |
| DOMAIN | tr[.]earn[.]top | Beacon infrastructure identified in the IOC list. |
| IPV4 | 144[.]91[.]87[.]221 | C2 and exfiltration server used by the Node-native payload to receive stolen data. |
| SHA1 | 0972859984decfaf9487f9a2c2c7f5d2b03560a0 | SHA-1 hash identified as a Sliver payload. |
| SHA1 | 2937c58115c131ae84a1b2a7226c666f6a27ef88 | SHA-1 hash identified as a Sliver payload. |
| SHA1 | 470ce679589e1c3518c3ed2b818516f27ccad089 | SHA-1 hash identified as a Sliver payload. |
| SHA1 | 5d368356bd49c4b8e3c423c10ba777ff52a4f32a | SHA-1 hash identified as a stealer. |
| SHA1 | 732226c0966fe29116b147e893c35ce7df1c8f1a | SHA-1 hash identified as a miner. |
| SHA1 | 7fe3826fc7b90e20c9fe76a7891eff350d73b6b3 | SHA-1 hash identified as malware. |
| SHA1 | 91152e6ffe0474b06bb52f41ab3f3545ac360e64 | SHA-1 hash identified as a stealer. |
| SHA1 | be86823d73a01266b096dab1628cfa2e4ca77265 | SHA-1 hash identified as a miner. |
| SHA1 | d6e97c9783f0907f1ee9415736816e272a9df060 | SHA-1 hash identified as a miner. |
| URL | hxxp[:]//185[.]229[.]32[.]220:21642/2lt4de8wgl54wtjgo8/winds | Malware download URL listed in the IOC table. |
| URL | hxxp[:]//193[.]34[.]213[.]150/nuts/bolts | Malware download URL listed in the IOC table. |
| URL | hxxp[:]//45[.]32[.]158[.]54/5e51aff54626ef7f/x86_64 | Malware download URL listed in the IOC table. |
| URL | hxxp[:]//47[.]84[.]82[.]8/index | Stealer endpoint identified in the IOC list. |
| URL | hxxp[:]//47[.]84[.]82[.]8/upload | Stealer exfiltration endpoint identified in the IOC list. |
| URL | hxxp[:]//8[.]222[.]213[.]56/index | Stealer endpoint identified in the IOC list. |
| URL | hxxp[:]//anywherehost[.]site/xb/runner[.]zip | Miner payload URL listed for the cryptomining campaign. |
| URL | hxxp[:]//anywherehost[.]site/xms/k1[.]sh?grep | Malicious script dropper URL listed for the cryptomining campaign. |
| URL | hxxp[:]//anywherehost[.]site/xms/kill2[.]sh | Malicious script dropper URL listed for the cryptomining campaign. |
| URL | hxxp[:]//inerna1[.]site/xms/k1[.]sh | Malicious script dropper URL listed for the cryptomining campaign. |
| URL | hxxp[:]//ip[.]inovanet[.]pt/systemprofile[.]zip | Miner payload URL listed in the IOC table. |
| URL | hxxp[:]//keep[.]camdvr[.]org:8000/BREAKABLE_PARABLE5 | Sliver payload delivery URL listed in the IOC table. |
| URL | hxxp[:]//keep[.]camdvr[.]org:8000/d5[.]sh | Sliver dropper URL listed in the IOC table. |
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelStolen credentials, keys, system data, and files are uploaded to attacker-controlled infrastructure over HTTP.T1059.004 · Unix ShellA Node-native payload uses child_process.exec to run commands when its magic URL path is requested.T1059.007 · JavaScriptAttackers execute shell commands and scripts inside compromised application containers.T1071.004 · DNSCompromised workloads send DNS callbacks to attacker-controlled OAST and beacon domains.T1082 · System Information DiscoveryPost-exploitation commands collect host and operating-system information, including hostname and OS details.T1087 · Account DiscoveryThe reported scripts enumerate users and home directories while searching for credentials and configuration files.T1105 · Ingress Tool TransferAttackers retrieve shell scripts, miner payloads, and Sliver binaries from external infrastructure.T1112 · Modify RegistryA Node.js payload overrides http.Server.prototype.emit to implant a persistent in-memory webshell.T1190 · Exploit Public-Facing ApplicationAttackers exploit the exposed React Server Components deserialization vulnerability in internet-facing applications to obtain initial code execution.T1496 · Resource HijackingMultiple campaigns deploy XMRig miners and connect them to attacker-controlled mining pools.T1543.002 · Systemd ServiceA miner campaign uses nohup /var/tmp/crond as a disguised persistence mechanism inside the container.T1552.001 · Credentials In FilesPayloads search for and steal SSH keys and other sensitive files from compromised hosts.T1552.003 · Shell HistoryAttackers attempt to access the cloud instance metadata service to retrieve IAM credentials.
CVE
CVE-2021-4034Attempt local privilege escalation (e.g., via CVE-2021-4034).CVE-2025-55182The disclosure of CVE-2025-55182, a critical Remote Code Execution (RCE) vulnerability in React, has sent shockwaves through the industry. Dubbed "React2Shell," this vulnerability allows attackers to bypass security
People
Malware
Vendors
Vercelit is a fundamental issue with how RSC payloads are handled, with implications reaching far beyond the Vercel ecosystem.WizActive Exploitation: Exclusive data from Wiz regarding what we are observing in the wild right now, from opportunistic cryptominers and "smash-and-grab" credential harvesting to sophisticated, persistent backdoors
Products
GKEIn multiple cases, attackers used the vulnerability to obtain an interactive shell inside application containers (for example, Next.js frontends running in Kubernetes/GKE). From there, we consistently see:KubernetesMost attacks target internet-facing Next.js applications and other containerized workloads running in Kubernetes and managed cloud services.Next.jsWhile initial reports have rightly focused on Next.js due to its massive popularity and default exposure, our research indicates the rabbit hole goes much deeper. This is not merely a framework-specific bug; it is aNode.jssimple connectivity checks to fully interactive reverse shells directly from the application runtime (Node.js / Next.js processes) to external command-and-control servers.ReactThe disclosure of CVE-2025-55182, a critical Remote Code Execution (RCE) vulnerability in React, has sent shockwaves through the industry. Dubbed "React2Shell," this vulnerability allows attackers to bypass securityReact Server Componentsand execute arbitrary code on the server by exploiting improper input deserialization within React Server Components (RSC).ViteThe Broader Scope: Why frameworks like Waku and Vite (with RSC plugins) are also vulnerable, and how the "default open" nature of Next.js - specifically the next-action header - makes it a prime target.WakuThe Broader Scope: Why frameworks like Waku and Vite (with RSC plugins) are also vulnerable, and how the "default open" nature of Next.js - specifically the next-action header - makes it a prime target.
Tools
curloften wrapped into one-liners and sent back to attacker-controlled infrastructure or oastify domains via curl or nc.ncwrapped into one-liners and sent back to attacker-controlled infrastructure or oastify domains via curl or nc.PythonBundles all findings into a single report file and uploads it via HTTP POST to attacker-controlled infrastructure, using whichever tool is available (curl, wget, or python).wgetBundles all findings into a single report file and uploads it via HTTP POST to attacker-controlled infrastructure, using whichever tool is available (curl, wget, or python).