Exploitation of Critical Vulnerability in React Server Components
Critical
Executive Summary
A critical Remote Code Execution (RCE) vulnerability, CVE-2025-55182, affects the Flight protocol within React Server Components and is under active exploitation, requiring immediate patching and enhanced monitoring. This vulnerability has a CVSS score of 10.0.
Vulnerability Details
Affected Product: React Server Components, Next.js, and other frameworks bundling react-server implementation
React: Versions 19.0, 19.1, and 19.2
Next.js: Versions 15.x and 16.x (App Router), as well as Canary builds starting from 14.3.0
Other frameworks: React Router, Waku, RedwoodSDK, Parcel and Vite RSC plugins
Identifier: CVE-2025-55182
CVSS Score: 10.0 (Critical)
Exploitation Status: Actively Exploited
Risk & Impact
Triage: Immediate patching of affected components is critical.
Attack Vector: An unauthenticated attacker can send a malicious HTTP request to a Server Function endpoint, leading to remote code execution.
Ease of Exploit: The attack complexity is low, requiring no user interaction or privileges, and has near-100% reliability.
Action Plan
Immediate Action: Upgrade React to versions 19.0.1, 19.1.2, or 19.2.1 and Next.js to patched versions. Downgrade Next.js canary releases to the latest stable 14.x release.
Workaround: Implement a custom AWS WAF rule to detect and prevent exploitation attempts.
Detection: Implement enhanced monitoring for exploitation attempts. The ISO has developed and deployed custom detections for exploit attempts and successful exploitations.
Relevant professional terms
Remote Code Execution (RCE)
A vulnerability that allows an attacker to execute arbitrary code on a remote system, potentially leading to data theft or system compromise.
CVSS Score
A numerical score representing the severity of a security vulnerability, with 10.0 being the most critical.
Apple Patches Two Actively Exploited Zero-Day Vulnerabilities
Executive Summary
Apple has released emergency updates to address two zero-day vulnerabilities, CVE-2025-43529 and CVE-2025-14174, which are being actively exploited in sophisticated, targeted attacks. Immediate patching of all affected Apple devices is crucial to prevent exploitation.
Vulnerability Details
Affected Product: iPhone 11 and later, iPad Pro 12.9-inch (3rd generation and later), iPad Pro 11-inch (1st generation and later), iPad Air (3rd generation and later), iPad (8th generation and later), iPad mini (5th generation and later)
Identifier: CVE-2025-43529
CVSS Score: N/A
Exploitation Status: Actively Exploited
Vulnerability Details
Affected Product: iPhone 11 and later, iPad Pro 12.9-inch (3rd generation and later), iPad Pro 11-inch (1st generation and later), iPad Air (3rd generation and later), iPad (8th generation and later), iPad mini (5th generation and later)
Identifier: CVE-2025-14174
CVSS Score: 8.8
Exploitation Status: Actively Exploited
Risk & Impact
Triage: Immediate patching is required due to active exploitation in sophisticated attacks.
Attack Vector: Exploitation occurs through processing maliciously crafted web content.
Ease of Exploit: Sophisticated attacks indicate a high level of expertise is needed, but successful exploits can lead to significant compromise.
Observed between July 2024 and February 2025, a DNG image-based exploit targeted a vulnerability in the Quram image parsing library on Samsung Android devices. Delivered via WhatsApp, the exploit facilitated remote code execution (RCE) and deployed spyware.
Key TTPs
Initial Access: Delivered via WhatsApp.
Execution: Exploiting a vulnerability in the Quram image parsing library to achieve remote code execution.
Defense Evasion: The zero-click nature of the exploit bypasses user interaction.
Campaign Analysis
The DNG exploit leverages a memory corruption bug during image parsing, leading to arbitrary code execution. This exploit highlights the increasing sophistication of mobile threats and the importance of robust image processing security.
Targeting & Infrastructure
Target Profile: Specific individuals, activists, or journalists are often targeted in such attacks.
Infrastructure: Exploits are delivered through WhatsApp.
Relevant Terms
DNG (Digital Negative): An Adobe open-source raw image format commonly used in digital photography.
Remote Code Execution (RCE): The ability to execute arbitrary code on a remote device or system.
Threat actors are distributing fake torrents of the movie 'One Battle After Another' to deliver Agent Tesla RAT. The malware is embedded within subtitle files, leveraging social engineering for initial access.
Key TTPs
Initial Access: Malicious torrents containing malware in subtitle files.
Execution: PowerShell scripts execute upon opening the subtitle files, leading to Agent Tesla RAT infection.
Defense Evasion: Code obfuscation, anti-virtual machine and sandbox detection.
Campaign Analysis
This campaign uses a novel delivery method by embedding malware in subtitle files. The technique highlights the evolving tactics of threat actors, exploiting user trust in common file types.
This guide highlights the importance of consistently implementing HTTP Strict Transport Security (HSTS) across AWS services to prevent vulnerabilities. Inconsistent HSTS configurations can lead to downgrade and man-in-the-middle attacks.
Key Findings
Inconsistent HSTS configurations expose applications to downgrade attacks, MITM attacks, and session hijacking.
Red Teams can exploit HSTS misconfigurations to simulate real-world attacks.
Proper HSTS implementation ensures data integrity and confidentiality by enforcing HTTPS.
The Bottom Line
Organizations must prioritize consistent HSTS deployment across all AWS services to strengthen their cloud security posture. Addressing fragmented configurations prevents attackers from exploiting unencrypted communication channels. By ensuring strict HTTPS enforcement, companies protect sensitive data and maintain user trust, which is crucial for regulatory compliance and overall risk management.
Relevant Terms
HSTS (HTTP Strict Transport Security): A policy that forces browsers to interact with a website only through HTTPS, preventing downgrade attacks.
MITM (Man-in-the-Middle) Attack: An attack where the attacker intercepts communication between two parties without their knowledge.
