React Native Community CLI OS Command Injection (CVE-2025-11953)

let RNCliIndicators = dynamic(['react-native', 'react_native_cli', '@react-native-community/cli', 'rn-cli']);
union DeviceProcessEvents, SecurityEvent
| where TimeGenerated > ago(7d)
| where (ProcessCommandLine has_any (RNCliIndicators) or ParentProcessName has_any (RNCliIndicators))
| where ProcessCommandLine matches regex @'[;&|`$()].*[;&|`$()\/\\]'
   or ProcessCommandLine has_any ('curl ', 'wget ', 'bash -', 'sh -c', 'powershell', 'cmd /c', 'nc ', 'ncat ', '/dev/tcp')
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, ParentProcessName, ParentCommandLine, InitiatingProcessAccountName, FileName
| extend SuspiciousIndicator = case(
    ProcessCommandLine has 'curl ' or ProcessCommandLine has 'wget ', 'RemoteDownload',
    ProcessCommandLine has 'bash -' or ProcessCommandLine has 'sh -c', 'ShellEscape',
    ProcessCommandLine has 'powershell', 'PowerShellExec',
    ProcessCommandLine has '/dev/tcp' or ProcessCommandLine has 'nc ', 'NetworkConnectivity',
    'CommandInjectionPattern'
  )
| order by TimeGenerated desc

index=* sourcetype IN (syslog, WinEventLog:Security, osquery:process_events, "xmlwineventlog:microsoft-windows-sysmon/operational")
| where match(process, "(?i)(react.native|rn.cli|@react-native-community)")
   OR match(parent_process, "(?i)(react.native|rn.cli|@react-native-community)")
   OR match(cmdline, "(?i)(react.native|rn.cli|@react-native-community)")
| eval injection_indicator=if(
    match(cmdline, "[;&|`$()]") AND match(cmdline, "(curl |wget |bash\s+-|sh\s+-c|powershell|cmd\s+/c|/dev/tcp|ncat?\s)"),
    "HIGH",
    if(match(cmdline, "[;&|`$()]"), "MEDIUM", "LOW")
  )
| where injection_indicator IN ("HIGH", "MEDIUM")
| table _time, host, user, process, parent_process, cmdline, injection_indicator
| sort -_time

sequence by host.name, user.name with maxspan=2m
  [process where process.name : ("node", "node.exe") and
   (process.command_line : ("*react-native*", "*@react-native-community*", "*rn-cli*") or
    process.parent.command_line : ("*react-native*", "*@react-native-community*"))]
  [process where process.name : ("sh", "bash", "zsh", "dash", "cmd.exe", "powershell.exe", "pwsh.exe") and
   process.command_line : ("*curl *", "*wget *", "*nc *", "*ncat *", "*/dev/tcp*", "*bash -i*", "*sh -c*", "*powershell*", "*Invoke-Expression*")]

SELECT DATEFORMAT(starttime,'YYYY-MM-dd HH:mm:ss') AS EventTime,
       sourceip, destinationip, username, "Process Name", "Command",
       CASE
         WHEN "Command" ILIKE '%curl %' OR "Command" ILIKE '%wget %' THEN 'RemoteDownload'
         WHEN "Command" ILIKE '%bash -i%' OR "Command" ILIKE '%sh -c%' THEN 'ShellExec'
         WHEN "Command" ILIKE '%powershell%' OR "Command" ILIKE '%cmd /c%' THEN 'WindowsExec'
         WHEN "Command" ILIKE '%/dev/tcp%' OR "Command" ILIKE '%nc %' THEN 'ReverseShell'
         ELSE 'InjectionMetachar'
       END AS InjectionType
FROM events
WHERE LOGSOURCETYPENAME(devicetype) IN ('Linux OS', 'Microsoft Windows Security Event Log', 'SyslogNG')
  AND (
    "Command" ILIKE '%react-native%'
    OR "Command" ILIKE '%@react-native-community%'
    OR "Process Name" ILIKE '%react-native%'
  )
  AND (
    "Command" ILIKE '%curl %' OR "Command" ILIKE '%wget %'
    OR "Command" ILIKE '%bash -%' OR "Command" ILIKE '%sh -c%'
    OR "Command" ILIKE '%powershell%'
    OR "Command" ILIKE '%/dev/tcp%' OR "Command" ILIKE '%nc %'
    OR ("Command" LIKE '%&%' AND "Command" LIKE '%;%')
  )
LAST 7 DAYS

_sourceCategory=linux/syslog OR _sourceCategory=windows/security OR _sourceCategory=endpoint/process
| where (process matches /(?i)react.native/ or cmdline matches /(?i)(@react-native-community|react-native|rn-cli)/)
| where cmdline matches /[;&|`$()]/ and (
    cmdline matches /(?i)(curl |wget |bash\s+-[ic]|sh\s+-c|powershell|cmd\s+\/c|\/dev\/tcp|nc\s+|ncat\s+)/
  )
| parse field=cmdline "*" as full_command
| count by _sourceHost, _sourceCategory, process, full_command
| sort by _count desc

rule cve_2025_11953_react_native_cli_cmdinject {
  meta:
    author = "df00tech"
    description = "Detects OS command injection exploitation of CVE-2025-11953 via React Native Community CLI"
    severity = "HIGH"
    priority = "HIGH"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-11953"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    (
      re.regex($e.target.process.command_line, `(?i)(react-native|@react-native-community|rn-cli)`)
      or re.regex($e.principal.process.command_line, `(?i)(react-native|@react-native-community|rn-cli)`)
    )
    re.regex($e.target.process.command_line, `[;&|\x60$()]`)
    re.regex($e.target.process.command_line, `(?i)(curl\s|wget\s|bash\s+-[ic]|sh\s+-c|powershell|cmd\s+/c|/dev/tcp|\bnc\s|ncat\s|Invoke-Expression)`)

  condition:
    $e
}

event_simpleName=ProcessRollup2
| filter (CommandLine = "*react-native*" OR CommandLine = "*@react-native-community*" OR ParentCommandLine = "*react-native*")
| filter CommandLine = "*[;&|`$()]*"
| filter (CommandLine = "*curl *" OR CommandLine = "*wget *" OR CommandLine = "*bash -i*" OR CommandLine = "*sh -c*" OR CommandLine = "*powershell*" OR CommandLine = "*cmd /c*" OR CommandLine = "*/dev/tcp*" OR CommandLine = "* nc *" OR CommandLine = "*ncat *")
| eval InjectionType=case(
    CommandLine="*curl *" OR CommandLine="*wget *", "RemoteDownload",
    CommandLine="*bash -i*" OR CommandLine="*sh -c*", "ShellEscape",
    CommandLine="*powershell*" OR CommandLine="*cmd /c*", "WindowsShell",
    CommandLine="*/dev/tcp*" OR CommandLine="* nc *" OR CommandLine="*ncat *", "ReverseShell",
    true(), "MetacharInjection"
  )
| table timestamp, ComputerName, UserName, FileName, CommandLine, ParentCommandLine, InjectionType
| sort -timestamp