Listen to this Post
The vulnerability resides in the `react-server-dom-` packages (e.g., react-server-dom-webpack) used by React Server Components. Server Function endpoints accept serialized data from client components over HTTP. The vulnerable code uses an unsafe deserialization process (e.g., eval()-like behavior or improper use of `Function()` constructor) on attacker-controlled payloads without proper validation or sandboxing. An unauthenticated attacker can send a specially crafted HTTP POST request containing malicious serialized JavaScript code to a vulnerable server endpoint. Because the deserialization process executes code in the server context, the payload is executed with the application’s privileges, leading to full Remote Code Execution before any authentication checks occur.
Platform: React Server Components
Version: 19.0.0-19.2.0
Vulnerability: Pre-auth RCE
Severity: Critical
Date: 2024-10-10
Prediction: 2024-10-31
What Undercode Say:
Check for vulnerable react-server-dom-webpack version npm list react-server-dom-webpack Curl payload to test endpoint (example structure) curl -X POST https://target/app/rsc -H "Content-Type: text/plain" --data-binary "@malicious_payload.bin"
// Example of malicious client component action payload
const maliciousAction = new Function('require', 'return require("child_process").exec("cat /etc/passwd")');
// Serialized and sent to server endpoint
How Exploit:
- Attacker identifies a target using a vulnerable React Server Components version.
- Crafts a serialized JavaScript payload that executes OS commands.
- Sends a POST request with the payload to the Server Function RSC endpoint.
- The server deserializes and executes the payload, granting the attacker remote code execution.
Protection from this CVE:
Update React and all `react-server-dom-` packages to the latest patched version immediately (e.g., 19.2.1 or later). Implement strict network controls to limit access to RSC endpoints. Use a Web Application Firewall (WAF) to filter anomalous POST requests.
Impact:
Complete system compromise. Attacker can execute arbitrary code, access sensitive data, and pivot within the network.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: www.cve.org
Extra Source Hub:
Undercode
