Elastic high stable eql

React2Shell (CVE-2025-55182) Exploitation Attempt

This rule detects exploitation attempts targeting CVE-2025-55182, a critical remote code execution vulnerability in React Server Components (RSC) Flight protocol. The vulnerability allows attackers to execute arbitrary code on the server by sending specially crafted deserialization payloads that exploit prototype chain traversal to access the Function constructor. This rule focuses on high-fidelity indicators of active exploitation including successful command execution responses and prototype pollution attack patterns.

View Source

Detection Logic

network where http.request.method == "POST" and
(
    // Successful CVE-2025-55182 RCE - command output in digest
    (
        http.response.status_code in (500, 303) and
        http.response.body.content like~ "*E{\"digest\"*" and
        http.request.body.content regex~ """.*\$[0-9]+:[a-zA-Z_0-9]+:[a-zA-Z_0-9]+.*"""
    ) or
    // Prototype pollution attempts in RSC Flight data (never legitimate)
    (
        http.request.body.content regex~ """.*\$[0-9]+:[a-zA-Z_0-9]+:[a-zA-Z_0-9]+.*""" and
        (
            http.request.body.content like~ "*__proto__*" or
            http.request.body.content like~ "*prototype*"
        )
    )
)

Field Validations

Loading…

Comments (0)

Loading comments...