Threat video1:00
GHSA-xqc2-xf4c-x3h3 React Server RCE: Detection & IOCs
Unauthenticated attackers gain server code execution through React Server Components. It ships 9 detection rules, 12 IOCs and a free Splunk SPL rule.
Read the full threat intel for GHSA-xqc2-xf4c-x3h3 React Server RCE: Detection & IOCs →
Chapters
- 0:00The hookCritical React server flaw.
- 0:04The storyFixed releases shipped that day.
- 0:11Attack pathMend maps it to a deserialization flaw.
- 0:26AttributionNo threat actor: this was defensive research.
- 0:31Indicators of compromise12 indicators to hunt: 5 hashes and 7 package names.
- 0:37MITRE ATT&CK techniques5 ATT&CK techniques, from initial access to impact.
- 0:42Remediation2 steps now: Upgrade react-server-dom-webpack, react-server-dom-parcel and react-server-dom-turbopack.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Critical React server flaw. Upgrade now.
0:05Fixed releases shipped that day.
0:07Only rare responses are affected.
0:11Mend maps it to a deserialization flaw.
0:14Shared buffers can corrupt the transport stream.
0:17Risk: code execution on the server.
0:19No workaround exists; upgrade the packages.
0:26No threat actor: this was defensive research.
0:3112 indicators to hunt: 5 hashes and 7 package names.
0:375 ATT&CK techniques, from initial access to impact.
0:422 steps now: Upgrade react-server-dom-webpack, react-server-dom-parcel and react-server-dom-turbopack.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.