Defending against the CVE-2025-55182 React2Shell vulnerability in React Server Components

MITRE Techniques

• [T1190 ] Exploit Public-Facing Application – Pre-authentication remote code execution via a crafted HTTP request exploiting React Server Components. Quote ‘critical pre-authentication remote code execution (RCE) vulnerability…could allow attackers to execute arbitrary code on vulnerable servers through a single malicious HTTP request.’
• [T1059.001 ] PowerShell – Encoded and obfuscated PowerShell commands were used post‑exploit to download and execute payloads. Quote ‘Identify encoded PowerShell attempts’
• [T1059.004 ] Unix Shell – Use of /bin/sh, bash commands and shell piping for download and execution in Linux containers/hosts. Quote ‘”/bin/sh -c (whoami)”‘
• [T1059.003 ] Windows Command Shell – Use of cmd.exe and command-shell invocations to run PowerShell and other commands after exploitation. Quote ‘cmd.exe … powershell -c “123*456″‘
• [T1105 ] Ingress Tool Transfer – Adversaries downloaded binaries and scripts from remote hosts and URLs observed in campaigns. Quote ‘hxxp://194[.]69[.]203[.]32:81/hiddenbink/colonna.arc’
• [T1055 ] Process Injection – Attackers manipulated processes and injected code to evade detection and run malicious payloads. Quote ‘A process was injected with potentially malicious code’
• [T1078 ] Valid Accounts – Unauthorized use of credentials and tokens (including Kerberos tickets and cloud instance tokens) to impersonate accounts and move laterally. Quote ‘Unauthorized use of Kerberos tickets to impersonate accounts and gain unauthorized access’