½üÆÚ£¬£¬£¬£¬£¬£¬React ÍŶÓÅû¶ÁËReact Server Components×é¼þÖеÄÒ»¸öÔ¶³Ì´úÂëÖ´ÐÐÎó²î£¨CVE-2025-55182£©¡£¡£¡£¡£¡£¡£React ·þÎñÆ÷×é¼þ£¨RSC£©ÊÇÒ»Ïî½¹µã¹¦Ð§£¬£¬£¬£¬£¬£¬ËüÔÊÐí¿ª·¢ÕßÔÚ·þÎñÆ÷¶ËÖ±½ÓäÖȾ×é¼þ£¬£¬£¬£¬£¬£¬²¢½«Ð§¹û·¢ËÍÖÁ¿Í»§¶Ë£¬£¬£¬£¬£¬£¬´Ó¶øÌáÉýÐÔÄÜÓëÓû§ÌåÑé¡£¡£¡£¡£¡£¡£ÏÖÔÚ£¬£¬£¬£¬£¬£¬¸ÃÊÖÒÕÒѱ»Next.js¡¢Shopify Hydrogen¡¢Gatsby 5µÈÖ÷Á÷¿ò¼ÜÆÕ±é½ÓÄÉ£¬£¬£¬£¬£¬£¬ÔÚµçÉÌƽ̨¡¢SaaS·þÎñÒÔ¼°ÄÚÈÝÕ¾µãµÈ¶à¸öÁìÓò¾ßÓÐÆÕ±éÓ¦Óᣡ£¡£¡£¡£¡£

ÔÚFOFA×ʲú²â»æƽ̨µÄ¼à²âÊý¾ÝÖУ¬£¬£¬£¬£¬£¬stake¹ÙÍøÇå¾²·¢Ã÷»ùÓÚNext.jsµÄÓ¦ÓÃ×ʲúÊýÄ¿ÒÑ´ï766Íò£¬£¬£¬£¬£¬£¬ÕâÒâζ×ÅÁè¼Ý200Íǫ̀·þÎñÆ÷¿ÉÄÜÃæÁÙÇ徲Σº¦¡£¡£¡£¡£¡£¡£ÓÈΪÑÏËàµÄÊÇ£¬£¬£¬£¬£¬£¬Ïà¹ØÎó²îµÄʹÓÃÀÖ³ÉÂʼ«¸ß£¬£¬£¬£¬£¬£¬¿¿½ü100%£¬£¬£¬£¬£¬£¬¹¥»÷ÕßÄܹ»ÎȹÌʵÏÖÍêÕûµÄÔ¶³Ì´úÂëÖ´ÐУ¬£¬£¬£¬£¬£¬¶ÔϵͳÇå¾²×é³ÉÑÏÖØÍþв¡£¡£¡£¡£¡£¡£

1.Îó²î¸ÅÊö

Îó²î±àºÅ£ºCVE-2025-55182

Îó²îÀàÐÍ£ºÔ¶³Ì´úÂëÖ´ÐÐ(RCE)

Îó²îÆ·¼¶£º¸ßΣ

Ó°Ïì¹æÄ££ºReact Server Components Ïà¹Ø¿ò¼ÜºÍ¿â£¬£¬£¬£¬£¬£¬ÀýÈçNext.jsµÈ¡£¡£¡£¡£¡£¡£

·¢Ã÷ʱ¼ä£º2025Äê12ÔÂ3ÈÕ

CVSSÆÀ·Ö£º10£¨ÆÀ·Ö¹æÄ£1-10£¬£¬£¬£¬£¬£¬¸ÃÎó²îÆÀ·Ö×î¸ß£©

POC״̬£ºÒѹûÕæ

1.1 Îó²îÓ°Ïì°æ°æ±¾

1.2 Îó²î¸´ÏÖ

·¢Ë͹ûÕæµÄHTTP¶ñÒâÇëÇóPayload¿ÉÒÔ¿´µ½·þÎñÆ÷ÀÖ³ÉÖ´ÐÐÎÒÃÇÒªÇóÖ´ÐÐwhoamiÏÂÁ£¬£¬£¬£¬£¬·þÎñÆ÷ÀÖ³ÉÖ´ÐÐwhoami²¢ÔÚÏìÓ¦Öзµ»ØwhoamiÏÂÁîÖ´ÐеÄЧ¹û¡£¡£¡£¡£¡£¡£

2.Îó²îÔ­ÀíÆÊÎö

FlightЭÒ飺

React 19ÒýÈëµÄ¿Í»§¶Ë-·þÎñ¶ËͨѶЭÒé

ʹÓÃÌØÊâµÄÐòÁл¯ÃûÌô«ÊäReact×é¼þÊ÷

Ö§³ÖÒýÓÃϵͳ£º$@N (chunkÒýÓÃ), $B N (BlobÒýÓÃ), $F N (º¯ÊýÒýÓÃ)

·þÎñ¶Ë·´ÐòÁл¯ºóÖ´ÐÐServer Actions/Components

CVE-2025-55182Îó²îÊÇÔ´ÓÚ·þÎñ¶ËÔÚ·´ÐòÁл¯ Server Action ÇëÇóʱδУÑéÄ£¿£¿£¿£¿£¿£¿£¿£¿éµ¼³öÊôÐÔµÄÕýµ±ÐÔ£¬£¬£¬£¬£¬£¬¹¥»÷Õß¿Éͨ¹ý²Ù¿ØÇëÇó¸ºÔØ»á¼ûÔ­ÐÍÁ´ÉϵÄΣÏÕÒªÁ죨Èç vm.runInThisContext£©£¬£¬£¬£¬£¬£¬½ø¶øÖ´ÐÐí§ÒâϵͳÏÂÁ£¬£¬£¬£¬£¬Ö»ÒªÓ¦ÓÃÒÀÀµÖаüÀ¨ vm¡¢child_process »ò fs µÈ³£¼û Node.js Ä£¿£¿£¿£¿£¿£¿£¿£¿é¼´¿É±»Ê¹Ó㬣¬£¬£¬£¬£¬¹¥»÷Õß¿Éͨ¹ý½á¹¹¶ñÒâRSCÇëÇóÔÚ·þÎñÆ÷¶ËʵÏÖí§Òâ´úÂëÖ´ÐС£¡£¡£¡£¡£¡£

3.ÐÞ¸´¼Æ»®

3.1 ¹Ù·½ÐÞ¸´¼Æ»®

ÐÞ¸´½â¾ö¼Æ»®£¨º¬Îó²î²¹¶¡£¡£¡£¡£¡£¡£©£º

¹Ù·½ÒÑÐû²¼Çå¾²²¹¶¡£¬£¬£¬£¬£¬£¬Çëʵʱ¸üÐÂÖÁ×îа汾£ºReact Server 19.0.1¡¢React Server 19.1.2¡¢React Server 19.2.1

ÏÂÔصØÖ·£ºhttps://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components

»òÕßͨ¹ýÏÂÁîÉý¼¶µ½Çå¾²°æ±¾£¬£¬£¬£¬£¬£¬npm install react@19.0.1 react-dom@19.0.1 next@15.0.5

3.2 stake¹ÙÍø·À»ðǽ·À»¤¼Æ»®

stake¹ÙÍøÍøÂç·À»ðǽÔÚÍøÂç½çÏß¾«×¼¹ýÂËЯ´øCVE-2025-55182Îó²î¹¥»÷ÌØÕ÷µÄ¶ñÒâÁ÷Á¿£¬£¬£¬£¬£¬£¬Í¨¹ýͨÓÃÐÍÎó²î+ÏêϸÎó²îµÄ¼ì²âÀíÄ£¬£¬£¬£¬£¬ÊµÏÖ¶Ôδ֪+ÒÑÖªÎó²îµÄ¾«×¼×èµ²ºÍ×è¶Ï£¬£¬£¬£¬£¬£¬WEBÓ¦ÓÃÇ徲ͨ¹ýÉî¶ÈÆÊÎöHTTPÇëÇó±¨ÎÄ£¬£¬£¬£¬£¬£¬¾«×¼Ê¶±ðÈçŲÓÃchild_process.execSyncµÄ¸ßΣ²ÎÊý¼°¶ñÒâ½á¹¹ÄÚÈÝ£¬£¬£¬£¬£¬£¬ÖþÀÎWeb²ã×ÝÉî·ÀÓùÆÁÕÏ¡£¡£¡£¡£¡£¡£

1.Éý¼¶·À»ðǽµÄIPS¹æÔò¿â°æ±¾µ½v20251208.1421°æ±¾

ÑéÖ¤¹æÔò13240144¡¢13240145¡¢13240146ÊÇ·ñÔÚ¹æÔò¿â¡£¡£¡£¡£¡£¡£ÔÚϵͳ--ÌØÕ÷¿âÉý¼¶Ä£¿£¿£¿£¿£¿£¿£¿£¿é¿ªÆô×Ô¶¯Éý¼¶ºó£¬£¬£¬£¬£¬£¬ÌØÕ÷¿â½«»á×Ô¶¯ÁªÍø¸üУ¬£¬£¬£¬£¬£¬×Ô¶¯¸üÐÂÌØÕ÷¿âµÄ×°±¸²»ÊܸÃÎó²îÓ°Ïì¡£¡£¡£¡£¡£¡£

2.δÁªÍø×°±¸¿ÉÒÔͨ¹ýµÇ¼stake¹ÙÍøÇå¾²ÔƹÙÍøhttps://secloud1.ruijie.com.cn/login£¬£¬£¬£¬£¬£¬ÏÂÔØ×îеÄIPS¹æÔò¿â

°ü¹Ü°æ±¾ÔÚv20251208.1421ÒÔÉÏ£¬£¬£¬£¬£¬£¬ÀëÏßÉý¼¶¹æÔò¿â¡£¡£¡£¡£¡£¡£

»ùÓÚÒÔÉÏÆÊÎö£¬£¬£¬£¬£¬£¬Õë¶ÔReact CVE-2025-55182ÕâÒ»CVSSÂú·Ö¸ßΣÎó²î£¬£¬£¬£¬£¬£¬stake¹ÙÍø·À»ðǽµÄ½¹µã·À»¤ÓÅÊƿɹéÄÉ×ÛºÏΪ“¿ì¡¢È«¡¢¼ò”Èý´óÌص㣺

ÏìӦѸËÙ£ºÎó²îÅû¶ºó24СʱÄÚ¼´Íê³É¹¥»÷ÌØÕ÷ÌáÈ¡Óë·À»¤¹æÔòͬ²½£¬£¬£¬£¬£¬£¬×ÊÖúÓû§ÔÚµÚһʱ¼äÆô¶¯ÓÐÓ÷ÀÓù£»£»£»£»£»

ÁýÕÖÖÜÈ«£ºÌṩÕë¶ÔÐÔ·À»¤¹æÔò£¬£¬£¬£¬£¬£¬¼´¿ª¼´Ó㬣¬£¬£¬£¬£¬ÎÞÐèÖØ´óÉèÖ㻣»£»£»£»

°²ÅÅÇáÓ¯£º×ÝÈ»ÔÝδÍê³Éϵͳ²¹¶¡Éý¼¶£¬£¬£¬£¬£¬£¬Óû§Ò²¿Éͨ¹ýÒ»¼üÆôÓùæÔò£¬£¬£¬£¬£¬£¬¿ìËÙ¹¹½¨Çå¾²»º³åµØ´ø¡£¡£¡£¡£¡£¡£