CVE-2025-55182 — Meta React Server Components Remote Code Execution

union DeviceProcessEvents, DeviceNetworkEvents, DeviceFileEvents
| where TimeGenerated > ago(24h)
| where InitiatingProcessFileName in~ ("node", "node.exe", "next", "next.js")
| where (
    (ActionType == "ProcessCreated" and ProcessCommandLine has_any ("child_process", "exec", "spawn", "execSync", "spawnSync", "eval", "Function(", "vm.runInNewContext", "__import__", "os.system"))
    or (ActionType == "FileCreated" and FolderPath matches regex @"(?i)(\\tmp\\|/tmp/|\\var\\|/var/).*\.(sh|py|pl|rb|elf|exe)$")
    or (ActionType == "NetworkConnectionFound" and RemotePort in (4444, 1337, 9001, 8080, 8443) and InitiatingProcessFileName in~ ("node", "node.exe"))
)
| extend RSCExploitIndicator = case(
    ProcessCommandLine has_any ("child_process", "execSync", "spawnSync"), "CommandExecution",
    ProcessCommandLine has_any ("eval", "Function(", "vm.runInNewContext"), "DynamicCodeEval",
    FolderPath matches regex @"(?i)(/tmp/|\\tmp\\)", "SuspiciousFileWrite",
    ActionType == "NetworkConnectionFound", "ReverseShellAttempt",
    "Unknown"
)
| project TimeGenerated, DeviceName, ActionType, InitiatingProcessFileName, ProcessCommandLine, FolderPath, RemoteIP, RemotePort, RSCExploitIndicator
| sort by TimeGenerated desc

index=* sourcetype IN ("WinEventLog:Security", "linux_secure", "osquery:results", "stream:http")
| eval is_node = if(match(process, "(?i)(node|next)"), 1, 0)
| eval is_suspicious_cmd = if(match(cmdline, "(?i)(child_process|execSync|spawnSync|eval|Function\\(|vm\.runInNewContext|os\.system|subprocess|shell_exec)"), 1, 0)
| eval is_suspicious_file = if(match(file_path, "(?i)(\/tmp\/|\/var\/tmp\/|\\\\Temp\\\\).*\.(sh|py|pl|rb|elf|exe)$"), 1, 0)
| eval is_rsc_rce = if(is_node=1 AND (is_suspicious_cmd=1 OR is_suspicious_file=1), 1, 0)
| where is_rsc_rce=1
| eval exploit_stage = case(
    is_suspicious_cmd=1 AND match(cmdline, "(?i)(child_process|exec)"), "InitialCodeExecution",
    is_suspicious_cmd=1 AND match(cmdline, "(?i)(eval|Function)"), "DynamicEvalAbuse",
    is_suspicious_file=1, "PayloadDrop",
    true(), "Unknown"
)
| table _time, host, user, process, cmdline, file_path, exploit_stage, src_ip
| sort -_time

sequence by host.hostname with maxspan=2m
  [process where event.type == "start"
   and process.name in~ ("node", "node.exe", "next")
   and process.args : ("*child_process*", "*execSync*", "*spawnSync*", "*eval*", "*vm.runIn*")]
  [any where event.category in ("file", "network", "process")
   and (
     (event.category == "file" and file.path : ("/tmp/*", "/var/tmp/*", "C:\\Windows\\Temp\\*") and file.extension in ("sh", "py", "elf", "exe", "pl"))
     or (event.category == "network" and destination.port in (4444, 1337, 9001) and network.direction == "egress")
     or (event.category == "process" and process.parent.name in~ ("node", "node.exe") and process.name in ("sh", "bash", "cmd.exe", "powershell.exe", "python3", "python"))
   )
  ]

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  logsourcename(logsourceid) AS log_source,
  sourceip,
  destinationip,
  destinationport,
  username,
  "processname",
  "commandline",
  "filepath",
  CATEGORYDESC(category) AS event_category
FROM events
WHERE
  INCIDR('0.0.0.0/0', sourceip)
  AND (
    LOWER("processname") IN ('node', 'node.exe', 'next')
    AND (
      LOWER("commandline") IMATCHES '.*?(child_process|execsync|spawnsync|eval|vm\.runinnewcontext|function\().*?'
      OR LOWER("filepath") IMATCHES '.*?(/tmp/|/var/tmp/|\\\\temp\\\\).*?\.(sh|py|elf|exe|pl)$'
      OR (destinationport IN (4444, 1337, 9001, 8080) AND eventdirection = 'R2L')
    )
  )
  AND starttime > NOW() - 86400000
ORDER BY starttime DESC
LAST 1000 EVENTS

(_sourceCategory=*endpoint* OR _sourceCategory=*process* OR _sourceCategory=*syslog*)
| where (%"process.name" in ("node", "node.exe", "next") or %"ProcessName" in ("node", "node.exe", "next"))
| where (
    matches(%"CommandLine", "(?i).*(child_process|execSync|spawnSync|eval|Function\(|vm\.runInNewContext).*")
    or matches(%"file.path", "(?i).*(/tmp/|/var/tmp/|\\\\Temp\\\\).*\.(sh|py|elf|exe|pl)$")
    or (%"network.dest_port" in ("4444", "1337", "9001") and %"network.direction" = "outbound")
)
| if(matches(%"CommandLine", "(?i).*(child_process|exec)"), "CommandExecution",
    if(matches(%"CommandLine", "(?i).*(eval|Function\()"), "DynamicEval",
      if(matches(%"file.path", "(?i).*/tmp/.*"), "FileDrop", "NetworkC2"))) as exploit_stage
| count by _sourceHost, %"process.name", %"CommandLine", %"file.path", exploit_stage
| sort by _count desc

rule cve_2025_55182_react_rce {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects CVE-2025-55182 React Server Components RCE exploitation"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-55182"
    yara_version = "YL2.0"
    rule_version = "1.0"

  events:
    $e1.metadata.event_type = "PROCESS_LAUNCH"
    $e1.principal.process.file.full_path = /(?i)(node|next)(\.(exe|js))?$/
    (
      $e1.target.process.command_line = /(?i)(child_process|execSync|spawnSync|eval|Function\(|vm\.runInNewContext)/
      or $e1.target.file.full_path = /(?i)(\/tmp\/|\/var\/tmp\/|\\Temp\\).*\.(sh|py|elf|exe|pl)$/
    )
    $e1.principal.hostname = $host

    $e2.metadata.event_type = "NETWORK_CONNECTION"
    $e2.principal.process.file.full_path = /(?i)(node|next)(\.(exe|js))?$/
    $e2.target.port in [4444, 1337, 9001, 8080, 8443]
    $e2.principal.hostname = $host

  match:
    $host over 5m

  condition:
    $e1 or $e2
}

#event_simpleName IN (ProcessRollup2, NetworkConnectIP4, FileWritten)
| ImageFileName = /(?i)(node|next)(\.(exe|js))?$/
| CommandLine = /(?i)(child_process|execSync|spawnSync|eval|Function\(|vm\.runInNewContext|__import__|os\.system)/ OR
  (TargetFileName = /(?i)(\/tmp\/|\\Temp\\)/ AND TargetFileName = /\.(sh|py|elf|exe|pl)$/) OR
  (RemotePort IN [4444, 1337, 9001, 8080] AND #event_simpleName = NetworkConnectIP4)
| groupby([ComputerName, ImageFileName, CommandLine, TargetFileName, RemoteIP, RemotePort])
| eval rce_indicator = case(
    CommandLine = /(?i)(child_process|exec)/, "ChildProcessSpawn",
    CommandLine = /(?i)(eval|Function\()/, "DynamicCodeEval",
    TargetFileName = /(?i)\/tmp\//, "TempFileWrite",
    #event_simpleName = "NetworkConnectIP4", "SuspiciousOutbound",
    true(), "Unknown"
  )
| select([ComputerName, ImageFileName, CommandLine, TargetFileName, RemoteIP, RemotePort, rce_indicator])
| sort(timestamp, order=desc)