Full Breakdown
Rapid Exploitation of React2Shell Vulnerability by Chinese Hackers
12/7/2025, 1:45:11 AM
Overview of the React2Shell Vulnerability
The React2Shell vulnerability, officially tracked as CVE-2025-55182, was disclosed on December 3, 2025, and has been categorized with a maximum severity score of 10.0 on the Common Vulnerability Scoring System (CVSS). This critical flaw affects React Server Components (RSC) and allows unauthenticated remote code execution (RCE) through specially crafted HTTP requests. The vulnerability arises from insecure deserialization in the Flight protocol used by React, which facilitates communication between servers and clients. The flaw has been addressed in React versions 19.0.1, 19.1.2, and 19.2.1.
Immediate Exploitation by Chinese Threat Actors
Within hours of the public disclosure, Amazon Web Services (AWS) reported that two China-linked hacking groups, Earth Lamia and Jackpot Panda, began exploiting the React2Shell vulnerability. Earth Lamia has a history of targeting sectors such as financial services, logistics, and government organizations across Latin America, the Middle East, and Southeast Asia. Jackpot Panda, active since at least 2020, primarily focuses on online gambling entities in East and Southeast Asia. AWS observed exploitation attempts through its MadPot honeypot infrastructure, indicating a coordinated and rapid response from these groups.
Attack Techniques and Observations
The exploitation attempts included executing Linux commands, creating files, and reading sensitive system files, demonstrating that attackers are not merely relying on automated scans but are actively refining their techniques against live targets. AWS noted that some threat actors were using both valid public proof-of-concept (PoC) exploits and engaging in manual debugging to enhance their exploitation methods. This behavior underscores a shift towards a volume-based approach, where attackers attempt to exploit numerous targets quickly, even using flawed PoCs.
Broader Implications and Security Community Response
The React2Shell vulnerability has raised alarms across the cybersecurity community, prompting the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to add it to its Known Exploited Vulnerabilities catalog. The agency has mandated that Federal Civilian Executive Branch agencies must implement necessary updates by December 26, 2025. The widespread use of React and Next.js in modern web applications means that approximately 2.15 million internet-facing services could be vulnerable, according to data from Censys.
Security experts emphasize the need for immediate action, urging organizations to upgrade to the patched versions of React and Next.js. Major cloud providers, including AWS and Cloudflare, have deployed temporary protections, but these are not substitutes for patching. The urgency is compounded by the fact that exploitation requires minimal effort and can be executed remotely without authentication.
Conclusion
The React2Shell vulnerability exemplifies the increasing speed at which threat actors, particularly state-sponsored groups, exploit newly disclosed vulnerabilities. The rapid weaponization of this flaw highlights the necessity for organizations to adopt rigorous patch management practices and to remain vigilant in monitoring for potential exploitation. As the cybersecurity landscape evolves, the React2Shell incident serves as a critical reminder of the importance of timely updates and proactive security measures.
