RondoDox: Nine Months of React2Shell in the Wild

The Vulnerability

CVE-2025-55182 (React2Shell) is a deserialization flaw in React Server Components that allows unauthenticated remote code execution via a single HTTP request.

CVSS Score: 10.0 (Critical)

• React 19.0, 19.1.0, 19.1.1, 19.2.0

• Next.js applications using React Server Components

• Any framework implementing the RSC "Flight" protocol

Discovery: Lachlan Davidson, disclosed November 29, 2025 Public disclosure: December 3, 2025 Time to exploitation: Hours

---

The Exploitation

Within hours of public disclosure, AWS threat intelligence observed China-nexus groups actively exploiting the vulnerability:

Group	Attribution
Earth Lamia	China state-nexus
Jackpot Panda	China state-nexus

• MINOCAT tunneler

• SNOWLIGHT downloader

• HISONIC backdoor

• COMPOOD backdoor

• XMRIG cryptocurrency miners

This isn't script kiddies. This is nation-state actors with pre-positioned exploitation capability waiting for high-value vulns.

---

The Botnet

The RondoDox botnet has been leveraging React2Shell for nine months—since before public disclosure.

Current exposure (as of January 4, 2026):

Country	Vulnerable Instances
United States	66,200
Germany	3,600
France	2,500
India	1,290
Total	84,916

Two-thirds of vulnerable systems are in the US.

---

Technical Details

The vulnerability resides in the react-server package's handling of RSC "Flight" protocol payloads.

1. Attacker sends malformed RSC payload via HTTP

2. Server fails to validate payload structure

3. Attacker-controlled data influences server-side execution

4. Arbitrary code executes with web server privileges

One request. Full compromise.

There is no workaround. You must patch.

---

The Timeline

Date	Event
~April 2025	RondoDox campaign begins
Nov 29, 2025	Vulnerability disclosed to React team
Dec 3, 2025	Public disclosure
Dec 3, 2025	Exploitation within hours
Jan 4, 2026	84,916 systems still vulnerable

Nine months of quiet exploitation before anyone knew.

---

Remediation

• React: 19.0.1, 19.1.2, or 19.2.1

• Next.js 13.x: Upgrade to 14.2.35+

• Rotate all application secrets

• Review logs for exploitation indicators

• Check for persistence mechanisms

There is no workaround. WAF rules may reduce exposure but do not eliminate the vulnerability.

---

IOCs

• MINOCAT (tunneling)

• SNOWLIGHT (downloader)

• HISONIC (backdoor)

• COMPOOD (backdoor)

• XMRIG (cryptominer)

Check threat intel feeds for associated infrastructure.

---

The Lesson

React2Shell demonstrates the modern vulnerability lifecycle:

1. Discovery → Private disclosure

2. Patch released → Public disclosure

3. Hours later → Nation-state exploitation

4. Months later → 85K systems still unpatched

The window between disclosure and mass exploitation is now measured in hours, not days. If you're not patching within 24 hours of critical CVEs, you're already compromised.

---

Sources

• AWS: China-nexus Cyber Threat Groups Exploit React2Shell

• Wiz: Critical Vulnerability in React CVE-2025-55182

• Google Cloud: Threat Actors Exploit React2Shell

• Microsoft: Defending Against React2Shell

• Datadog: CVE-2025-55182 React2Shell RCE

---

About DugganUSA: We publish free threat intelligence for the 99% who can't afford enterprise security. Our STIX 2.1 feed includes React2Shell exploitation indicators.

STIX Feed | OTX Profile

---

Her name is Renee Nicole Good.