React2Shell Exploited to Gain RCE on Production Next.js App

Dec 10, 2025 · Original article ↗

Summary

A Hunt IO investigation found attackers exploited React2Shell (CVE-2025-55182) on a production Next.js app, confirmed command execution, and attempted to deploy malware and persistence. Container restrictions blocked much of the activity, but logs showed integrity alert

Key points

Logs from a production Next.js application confirmed successful exploitation of CVE-2025-55182, with attackers executing shell commands through Node.js child_process.spawnSync().
The attackers attempted to deploy Mirai and other IoT-style payloads, run obfuscated scripts, and establish persistence using four C2 servers.
A restricted container environment—including missing bash, curl, and sudo, plus process timeouts—blocked or limited several payload and persistence attempts.
The investigation recorded 330 file-integrity alerts involving /app/logs/app.log; the article notes these may partly reflect logging of the attack itself.
A JWT for a user account appeared in application logs, creating potential session-impersonation risk; the article recommends invalidating sessions and reviewing log redaction.
The report advises organizations using React Server Components to patch and review logging, filtering, and container security controls.

Article Details

Victim Organization: Not disclosed
Victim Domain: avangenio.com
Incident Type: CVE-2025-55182 remote code execution, followed by attempted malware deployment and persistence, file integrity violations, and exposure of a JWT in application logs
Data Types Exposed: Email address
Username
JWT authentication token
Affected Records: One user's JWT and account identifier were present in the logs; unauthorized use is not confirmed.
Affected Data Size: Not disclosed
Operational Impact: Remote code execution on the application server was confirmed. Attempts to deploy and execute payloads and establish persistence were blocked or failed in the restricted container. File integrity monitoring recorded 330 violations on /app/logs/app.log, and a user's JWT was logged in plaintext.
Ransom Or Extortion: None reported
Claim Status: confirmed

Indicators of compromise

Type	Indicator	Context
IPV4	`128[.]199[.]194[.]97`	C2 server used to distribute persistence scripts on port 9001.
IPV4	`176[.]117[.]107[.]154`	C2 server used to distribute the Mirai bot binary.
IPV4	`193[.]34[.]213[.]150`	Primary Mirai campaign C2; the article reports 544 connection attempts.
IPV4	`193[.]34[.]213[.]152`	Additional infrastructure linked to the primary C2 by a shared SSH key fingerprint; the article attributes it to the same threat actor's infrastructure.
IPV4	`193[.]34[.]213[.]153`	Additional infrastructure linked to the primary C2 by a different SSH key fingerprint; identified by the article as associated infrastructure.
IPV4	`193[.]34[.]213[.]157`	Additional infrastructure linked to the primary C2 by a shared SSH key fingerprint; the article attributes it to the same threat actor's infrastructure.
IPV4	`193[.]34[.]213[.]159`	Additional infrastructure linked to the primary C2 by a shared SSH key fingerprint; the article attributes it to the same threat actor's infrastructure.
IPV4	`78[.]153[.]140[.]16`	Hidden C2 address embedded in the base64 payload.
URL	`hxxp[:]//128[.]199[.]194[.]97:9001/setup2[.]sh`	Persistence-dropper URL used by the attack script.
URL	`hxxp[:]//176[.]117[.]107[.]154/bot`	Payload-download URL used to retrieve the Mirai bot binary from the C2 server.
URL	`hxxp[:]//193[.]34[.]213[.]150/nuts/`	Malicious file repository directory on the campaign C2, identified as serving IoT malware.
URL	`hxxp[:]//193[.]34[.]213[.]150/nuts/bolts`	Payload URL used to retrieve the shell dropper from the campaign C2.
URL	`hxxp[:]//193[.]34[.]213[.]150/nuts/x86`	Payload URL used to download the x86 IoT binary from the campaign C2.
URL	`hxxp[:]//78[.]153[.]140[.]16/re[.]sh`	Payload URL retrieved from the hidden C2 by the decoded malicious script.