Bugcrowd Security Flash: CVE-2025-55182 (React2Shell) UPDATE

Hey everyone, this is Casey and Matt coming to you with another bug crowd security flash. We're talking today about the reactor shell vulnerabilities that, you know, basically dropped last Friday. We're recording this on Wednesday and kind of a lot's happened since then. So, you know, I'm joined by Matt who's a technical program manager, you know, know hacker from way back in the day and very much on the coal face in terms of understanding what's happened over the last couple of days, but also what we can expect going forward. So we wanted to jump on and talk about that. How you doing, Matt?

I'm doing good. I'm living the life and yeah, seeing some cool stuff

and I appreciate all of the, the, the midnight oil that's been burnt. Yeah, definitely inside of bug crab. But obviously that's happening right across the Internet at the moment on the bad guy side and the good guy side as this thing rolls out. So yeah, let's, let's get into it. What are some of the things that you're seeing? What do you want to dig into and inform the public about at this point?

Yeah, first of all, shout out to all the incident response teams right now. I'm just happy that I don't have

your job pouring out of 40 for those.

So this vulnerability has of course involved. If we're talking about what we're seeing from threat actors. I mean state actors have been abusing it on a wider scale and yeah, all kinds of Darknet chatter as well. New POCs popping up, new WAF bypasses every day. And yep, what was really interesting to me is the way it's being utilized. We now have Chrome extensions that automatically check if a website or an API is vulnerable. We now have ways of putting a POC on basically every device, even if it doesn't make sense. I've seen a POC for Flippa zero. I'm like, eh, okay. And dug down a little bit deeper. You're like why? And then it hit me and then I saw another blog post by Bitdefender because it's now in smart homes as well. Because we have applications, we have devices, we have cameras or people have cameras. I don't. Or stuff in their smart homes because I'm fucking paranoid that just use React server components. Right.

And let's double click on that because when we're talking before we jumped on that was a piece. I think there's some angles to it that I would like to cover off. But to me this one's really interesting because I think when the news of the vulnerability first hit hit. React JS is a really popular framework for kind of modern web apps. So like the immediate attack surface that you think about is your kind of more recent like cicd, native, cloud, native kind of companies that are using this stuff on the front end. And it's mostly like a server side issue that you're going to encounter if you get successful exploitation of the rce. But what you're talking about, which I think is a really interesting kind of neglected aspect of what's likely to happen off the back of this bug is how common React with RCS enabled is in hardware, right?

Yeah, yeah, exactly. So the Bitdefender blog post that I mentioned basically said what they're seeing on the end of what they're blocking and the targets range from smart plugs, network attack devices like a NAS, routers, cameras, TVs or anything basically that, that has this thing in it. And Mirai Botnets we all know and love are abusing this at scale of course. And funny enough, of course what it's going to be used to, yes, of course you can break into people's homes, but you're going to deploy crypto miners because that's the first thing that people do and that's what actually happening. And we've seen also some threat actors using the same method with yeah, web or API based stuff to deploy crypto miners because it's the easiest and fastest way to make money on a scale before you dig in into every target that you find. Because like you said, React is such a widely used framework for modern everything. The easiest way is just to deploy crypto miners and then see, okay, what does the target actually do while it's now mining my crypto? Yeah, it's a multi stage exploit here or exploit.

It's interesting on the crypto side as well because that was like Friday like the. We get a heads up that something's about to catch fire on the Internet, we start to see news of the vulnerability, then we start to see it pop up on the queue and Asset Note released their testing tool and all that kind of stuff that's in the first 12 hours. And from what I can tell looking back on things, the, like the successful rce, successful development of a reliable exploit to achieve RCE and then that being coupled with a crypto miner that happens sometime on like Friday night and I'm talking Sydney time. Yeah, by the way that's, that's pretty quick in terms of turnaround time and weaponization. The thing that's Been interesting that's come out since is that a lot of that activity seems to have come from the dprk, from North Korea. And given the fact that like their offensive teams on the state side are mostly focused on generating revenue for the country, that makes total sense.

That's how it would definitely just get in the quick box and then see. Okay, what. Can we actually figure it out? Yeah, yeah. I mean you, you have to start somewhere. If we look back at what happened last, there was also this Iranian hacking group who was boasting about, and this is not really egg to shell related, but basically the same round they were boasting about that they hacked the. Yeah. Tel Aviv and Ben Gurion Airport. Turns out they didn't. They hacked the Bangkok. The Bangkok airport. But they missed. Yeah. So that was fun.

One error.

But yeah, but that's basically it. You go in, you're doing stuff pretty quick, focus on the wrong hack. But yeah, deploy stuff and then try to exploit more. Right. And yes, a little bit like double what we call it again. Yeah. If you do double ransomware stuff. So you first, you first encrypt everything. Demand money for that and. Yeah, exactly. And then go back and say, yeah, okay, you paid the money for this, now pay for getting your data back or not us releasing it, holding the data hostage. Yeah. Now you have the third stage, the early stage with like deploying crypto miners. So three stages. So be very careful here, folks.

Yeah. So in terms of. And bringing it back to the, to the attack surface side of things with. I just want to make sure I get this right and we're making it clear for the listeners. So when you're talking about Mirai and different other kind of botnets, botnets that are used to create resnets that are sold off by residential proxy providers, there's all of these different kind of crime models to capitalize on. Basically just opportunistically owning anything on the Internet.

Right. Yeah.

I guess what you're saying is the reactor shell vulnerability, because that's not the botnet component in and of itself. It's a way that attackers can load that component onto a new set of targets. So really what it nets out to is that we're going to see a whole lot of new nodes join these bot armies, I guess over the next period of time.

Yeah, definitely. The funny thing about Mirai or any kind of botnet and Mirai is just technically speaking, very interesting botnet, is that it's behaves like a worm. So it replicates itself onto every host that it can get teeth and so it scales pretty, pretty fast. So having access to just one single node with hundreds of, yeah, bots there, and it's being sold on the dark web now pretty quickly. The price has gone up a lot because you now have the ability to do that. And especially with the DPRK that you just mentioned, what they are using it for is to deploy Azure, which is just a remote access trojan that uses the Ethereum protocol. So not only for crypto mining, but it also makes things harder to detect, for instance, response teams as well, so. Exactly. You have this multiple ways of infiltration on scale. And so it's like we said in the last Security Flash, patch your stuff. It's so fast and quick. Yeah, yeah, assume breach.

That brings me to another thing. And I know we've talked about this, you and Shreya, I think talked about this on the last Security Flash, but it's something that to me has been really interesting to observe. And like in my head I'm contrasting it with log four shell. A lot of similarities, same time of year, it's welcome to the first week of December. There's always a trash fire of some sort. But the one that was most similar to this that I can think of is Log four shell. Definitely a library that's just freaking everywhere. And then all of a sudden there's some fairly like trivial ways to exploit it to get a pretty huge impact, I guess seeing to me like the initial reaction to this React vuln was a bunch of people sounding the alarm, but then a whole lot of conversation around the fact that like rcs, which is the vulnerable component in React, is not something that's always turned on. And it was almost downplayed a little bit initially, but since then we've seen like exploitable code paths in dependencies. We've seen it turning up places where people didn't think it would be just because it was enabled by mistake. Like you said before, it turns out that it's in a whole bunch of hardware that's now being exploited to build out botnets. All those different things, I guess. What's your. When you say patch the things, like if you don't necessarily have conviction that you need to patch the things, what should someone do? If you're inside an organization and you're freaking out about this, but you're not necessarily getting the buy in to go off and actually do the work to create a patch for your particular product or to patch your particular environment, what would be your advice to people in that position right now?

Honestly, move jobs. No, here's the thing.

Go on vacation.

Yay. This is as serious as 10.0 this is. It's as bad as it gets. I can't think of any reason why you would not patch it, to be honest. This is the worst stuff that has been happening in the last month, if not a year at least, or since. Luck for J. Basically, like you said, because it's so easy to exploit the way that it is exploited, you just basically do use references within your curl request. You can just use a payload to get secrets to deploy stuff on these nodes. If you haven't patched, assume you're already been breached. Honestly, if you look at the Shodan logs and go in and for those people who don't on the call, don't know what Shodan is, it's basically a way to see what every IP address or every host or every endpoint is using online in the web. Yeah. And if you go on there and just search for the vulnerable versions of any of the affected packages or RCS or node js, there's still a lot, and I'm talking hundreds of thousands out there that are still unpatched and I would assume reach. But to your point, it's not only about organizations. Right. If your organization does not want to patch it for whatever reason, you need to take this offline. And the same with personal devices. If you are unsure that in your home, your smart home, your doorbell, your smart plug, whatever, right. Uses this stuff and there's no vendor sign, there's no update, I would unplug. Honestly, this is the. I know, drastic move. Yeah, it's a drastic move, but sometimes you got to pull the plug. Even though the security community is, oh, no, we need the logs. Yeah, I don't care. The logs. If somebody can. Can hack my home. Yeah.

If the logs are showing that I'm mining cryptocurrency for the dprk, then yeah, maybe it's time to turn the, the smart thermometer off.

Yeah, exactly. That's the advice that I have. Patch or pull.

So that's. I like, I agree with that. From a risk standpoint, I think it's not necessarily practical and it requires absolutely everyone to be aware of this problem, which we can't necessarily expect that to happen.

Yeah.

So how do we put pressure on, I guess particularly product vendors that might be behind the eight ball on. On. On patching their stuff. So going back to the whole kind of hardware and IoT problem, right, like product vendors that have vulnerable libraries that aren't necessarily thinking through that part. How do we put pressure on them to make sure that those patches are at least available in the first place?

That's a good question. So there's always the way that the consumer has power, right? You need. So you can write a lot of emails, you can write a lot of social media stuff, right, for them to patches. So put on pressure. But first of all, you need to be aware, right, about the stuff that you have at home. Not everybody is that. Not everybody is as paranoid as we are. And also maybe have no idea how to do that, how to get in contact with the vendor, maybe have not even set up their stuff themselves. So if you have somebody who has set it up, please notify them. Hey, I've read about this. I heard about this. Does this impact my smart doorbell, for example, that you set up? Like for example, my mom, right. I've set up stuff for her in her home. I know it's not vulnerable because it does not use that anymore. And the vendor is great. But if you're managing this for your parents or you mention it for a friend, please check. And on the way of putting pressure on vendors, as a consumer, write throw out, don't buy. If you have the ability to or the means to buy new stuff that the vendor actually patched, great. If not, yeah, please update as soon as something is that's like I said, patch your stuff also means update your stuff, go into the app. If then update, update.

Yeah, definitely. I do think to me that whole side of it on the product security side, because from my perspective there's two kind of distinctions versions of the problem that exist. On the Defender side right now, there's like the Corpsec version where you've got production environments that have these libraries in them that you need to go off and fix. And a lot of people are really, that's the, the incident response, triage and vulnerability management posse that we pulled out of 42 at the beginning of the call because they're definitely having a rough week. But then on the other side, you've got this whole kind of product security component where it's not necessarily a single thing that's being hosted that you need to go off and fix. It's a, it's a. I don't believe Apple is having a problem with this on their hardware devices. But as an example, if they were, you've got to go off and then find a way to fix it, deploy that patch, do all those different things. That's a product security issue, not so much a corporate Security issue.

Yeah.

So yeah, on the pressure side, I think going back to what you said, for folks that like scan your home network, see if there are things that are vulnerable there, use Asset Note, have a free tool that they've released that you can just run across IP addresses to see if anything pops up as being vulnerable. That's probably a decent tool to use for this. And if there are vendors and products in your home network that don't have patches and are vulnerable to this thing, do something about it, Contact the vendor, post on social media, do whatever it is that you have to do as a security researcher to draw attention to that and start back pressure on these guys to get this stuff fixed up. Because yeah, like the velocity of exploitation on this thing has been absolutely wild to watch. I personally think it's, it's partly driven by the availability of AI engineering tools. Definitely just to be able to vibe Chrome stuff and oh, I want to create a Chrome browser extension that just pops this on the fly. Like you could use Claude to build that if that wasn't something that you were capable of actually building yourself previously. And there's a lot of different people working on a lot of different things right now that leverage vulnerability. So getting it like stamped out as much as possible I think is pretty important.

Yeah, definitely. I've seen people just basically spin up an environment in yeah seconds deploying a WAF on there that supposedly mitigate the kind of payloads and then just using AI on a scale to try and circumvent that.

Yeah, to mutate to create WAF events.

Exactly. That was done in minutes. I seen a live broadcast, I think it was Twitch, I don't know, I can't remember. It might be YouTube where a guy was like okay, let's try to bypass this vendors waf. Yeah, for react to shell. He set it up in minutes and they're like okay, I'm going to use AI has a custom model train which is also available publicly and basically said okay, I want you to get the, with the, with any kind of payload that you can think of. I want you to get this secret which is stored on slash, etc. Path proc. Stuff like that secret TXT within minutes, I kid you not, 10 minutes at five or six bypasses which they immediately reported to the bath when they fixed it. This is, yeah, this, the speed is, the velocity of exploitation is just huge.

Yeah, yeah. So yeah, it's an interesting time. It's funny like the combination of how widespread this bug is then how many different kind of motivations there are for threat actors around the world at this point in time. Plus this kind of wild card of AI like accelerating the traditional kind of cat and mouse game that we play after something like this happens to the point where the cycle times on. On innovating past defenses are. So yeah, it gets me thinking a lot around. We probably need to start thinking about other ways to do this because the kind of the blacklist whack a mole model for putting out Internet trash fires like this one. I think we're getting to the end of that being an effective strategy.

Yeah. Which is a whole 100% and I agree currently that's what other companies are doing or companies are doing. They're fighting fire with fire. So it's AI versus AI right now. So we got the dead Internet theory where just eyes are talking to each other. Where you got an AI mitigation center on the WAF deployed which is basically seeing. Okay, this payload comes in, analyzes this. Okay, this is actually malicious. It's trying to do this and that and then pings the security and pings the incident response team. This IP maybe automatically blocks this ip then sees another payload coming from a different. But of course with botnets that's huge. But yeah, we are fighting fire with fire right now on so many fronts.

We just end up with a lot of fire flying around.

Yeah, exactly. We end up with a lot of. And we all know what's going to happen with that. And I'm not saying that I know any proper solution. People much smarter, much smarter than me are probably thinking, hey, what about this or what about that? Yes, please let me know. I want to hear about these ideas. I can recommend this to customers.

We can chat off camera about that one because it's something that I've definitely been giving some thought to. But yeah, I guess the summary for this one, we've covered a bunch of different grounds and thank you for everyone who's tuned in here, really. I guess what it comes down to is the idea that like vibe crime to effectively like create effects on top of this vulnerability, guys put the ability to do that in the hands of way more people than was previously true. I think we used to be able to anticipate the behavior of threat actors because there was this like technical like you must be this tall to ride. And the folks that were above that level generally were all working for an agency or a particular cybercrime group or whatever else. So the kind of impacts that you can expect from them are semi predictable at the very least that feels like it's gone out the window a little bit because everyone can just build whatever the heck they want to.

Yeah.

So there's that and we're seeing that like the chrome extension, all of the stuff going on with crypto mining, using this to basically expand botnets, like that's all happened in four or five days, which is ridiculously fast. So that's a really, I think, important thing for people to be aware of. Probably the second one is the hardware threat vector that you mentioned that I actually hadn't thought that through at all until we jumped on the pre call for this. For folks that are thinking about product security, for think. For folks that are thinking through the implications of botnets on their organization, like, that is definitely something to be thinking about. And like we said before, like putting back pressure on product vendors to make sure they're patching this stuff, I think that's something that we can all participate in. For product vendors that are thinking about how to do that better. Start a vdp, run a bug bounty program, get eyes in whatever form you can onto your products so that when this stuff happens you can get security feedback and get ahead of it and build trust with your consumer audience as well. I don't know if there's any other kind of main takeaways here, but it's been great to catch up, man. It's definitely an interesting, interesting week that we're having.

Definitely. So I think we are going to get some water buckets for all these fires because. Yeah, but yeah, it's an interesting week in a security space. And last funny anecdote before we end this call. When I joined Buck Crowd four years ago. Yes, four years ago. The first thing in my first week was Luck4J. So I joined during that incident. Wow. And now I'm dead.

But yeah, it does feel very familiar. It's actually. It's fun to be able to talk about this. For folks that aren't on the inside of what we get to see in triage queues and seeing what's happening on the research side as well as on the Defender side, it does feel very familiar to what we experience with log 4J. Yeah, it's just. It feels like a lot faster and a lot more kind of targeted towards actual criminal objectives as opposed to just doing research and figuring it out.

Exactly.

That feels like the big difference. Yeah. Cool. All right, well, thanks, Matt. Really appreciate your time. Thanks for chatting.

Yeah, cheers. Bye bye.