React2Shell — اجرای کد از راه دور در React Server Components

React2Shell is one of the most dangerous vulnerabilities discovered in 2025, affecting the React Server Components (RSC) rendering pipeline.

## Vulnerability Overview
A critical Remote Code Execution (RCE) vulnerability exists in the server-side rendering pipeline of React Server Components. An unauthenticated attacker can exploit this flaw by sending specially crafted HTTP requests to the RSC endpoint, achieving arbitrary code execution on the server.

## Technical Details
- **Vulnerable Component:** React Server Components rendering pipeline (react-server-dom-webpack)
- **Attack Vector:** Network (remote, no authentication required)
- **Root Cause:** Insufficient input sanitization in the RSC serialization/deserialization mechanism. The server deserializes client-provided component references without proper validation, allowing injection of arbitrary module paths and function calls.
- **Attack Complexity:** Low — a single malicious HTTP request is sufficient.
- **Exploitation in the Wild:** Active exploitation has been confirmed by multiple threat intelligence sources. Attackers are using this vulnerability to deploy web shells and cryptocurrency miners on affected servers.

## Impact Assessment
- Full Remote Code Execution on the server with the privileges of the Node.js process.
- Complete access to the server filesystem, environment variables, and secrets.
- Ability to install backdoors, pivot to internal networks, and exfiltrate sensitive data.
- Potential supply chain compromise if the server has access to CI/CD pipelines or package registries.

## Affected Versions
- React 19.0.0 – 19.1.3 (with RSC enabled)
- Next.js 14.x and 15.x (App Router with RSC mode)
- Any custom RSC implementation using react-server-dom-webpack < 19.1.4

## Proof of Concept
A public PoC is available demonstrating the exploitation via a crafted RSC flight payload. The payload injects a malicious module reference that, upon deserialization, triggers arbitrary code execution.