React2Shell: Technical Deep-Dive & In-the-Wild Exploitation of CVE-2025-55182

MITRE Techniques

• [T1190 ] Exploit Public-Facing Application – The vulnerability is exploited for RCE against internet-facing Next.js and other RSC servers (‘critical Remote Code Execution (RCE) vulnerability in React’).
• [T1059 ] Command and Scripting Interpreter – Attackers obtain interactive shells and run one-liners, base64-encoded scripts, and tooling via curl/wget/nc (‘interactive reverse shells’ and ‘one-liners … sent back to attacker-controlled infrastructure via curl or nc’).
• [T1082 ] System Information Discovery – Adversaries collect system and environment details (whoami, hostname, env vars) to fingerprint compromised containers (‘whoami, hostname, environment variable dumps’).
• [T1083 ] File and Directory Discovery – Recursive scans of filesystem paths for config and keys target .env, JSON/YAML configs, SSH keys and other secrets (‘Recursively scans key filesystem paths (/home, /root, /etc, /var/www, /opt) for config and key material’).
• [T1071.004 ] Application Layer Protocol: DNS – DNS-based beaconing to oast*. domains is used to confirm execution and egress and to fingerprint targets (‘extensive use of oast*. domains and similar callback infrastructure’).
• [T1071.001 ] Application Layer Protocol: Web Protocols – Exfiltration and C2 use HTTP(S) endpoints and HTTP POST uploads to attacker infrastructure (‘Bundles all findings into a single report file and uploads it via HTTP POST to attacker-controlled infrastructure’).
• [T1105 ] Ingress Tool Transfer – Attackers retrieve and run external payloads (downloaders, XMRig, Sliver payloads) from attacker-controlled hosts (‘downloaded shell scripts from a dynamic DNS host that in turn fetched Sliver payloads (64-bit ELF binaries) and executed them’).
• [T1496 ] Resource Hijacking – Compromised containers are used to deploy cryptominers and hijack compute for Monero mining (‘cryptomining campaigns leveraging CVE-2025-55182’ and XMRig deployment examples).
• [T1053.005 ] Scheduled Task/Job: cron – Adversaries use nohup and disguised cron-like processes for persistence inside containers (‘using nohup /var/tmp/crond as a disguised persistence mechanism inside the container’).
• [T1005 ] Data from Local System – Attackers collect sensitive files and secrets from local paths (SSH keys, .aws, wallet data) for credential harvesting and lateral/cloud escalation (‘Targets common cloud/dev paths such as .ssh, .aws, .kube, .config/gcloud, and multiple cryptocurrency wallet locations’).
• [T1531 ] Cloud Instance Metadata Access – Adversaries attempt to retrieve IAM credentials from the instance metadata service to escalate cloud privileges (‘Attempts to access the cloud instance metadata service at 169.254.169.254/latest/meta-data/iam/security-credentials/’).