Critical vulnerability in React Server Components which can allow unauthenticated remote code execution.
Severity: Critical
Identified Threat
We have detected a suspected vulnerability in your react2shell servers. If this vulnerability is exploited, it could allow a threat actor to execute remote code, meaning they could take control of this server, access data stored on the server, and potentially spread to other servers and devices on the same network.
This vulnerability also allows the threat actor to run remote code before authentication or validation occurs, meaning they do not need to have any login information to utilise this vulnerability.
Please refer to:
Recommendations
Option 1: Update the component versions
We recommend that you manually assess whether your servers or containers may contain this vulnerability. Please see below for a list of affected versions. If your servers or containers match the affected versions, you should consider implementing patches immediately. React and Next.js have released fixes for the impacted packages. We would suggest prioritizing internet facing assets first. to the following patched versions are best practice.
The vulnerability is present in versions 19.0, 19.1.0, 19.1.1, and 19.2.0 of:
- react-server-dom-webpack
- react-server-dom-parcel
- react-server-dom-turbopack
Option 2: Monitor for suspicious activity
Where practicable, It would also be useful to monitor for exploitation events, leveraging software such as CrowdStrike or Bitdefender.