Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Internet-Scale Measurement of React2Shell Exploitation Using an Active Network Telescope

Aakash Singh, Kuldeep Singh Yadav, Md Talib Hasan Ansari, V. Anil Kumar

Abstract

The increasing adoption of server-side component-based web frameworks has introduced new application-layer attack surfaces that remain insufficiently understood at Internet scale. On 3 December 2025, a critical remote code execution vulnerability (CVE-2025-55182) in React Server Components, referred to as React2Shell, was publicly disclosed and subsequently observed being exploited in the wild. Despite its critical severity and a CVSS base score of 10.0, there is limited empirical understanding of how this vulnerability is exploited across the Internet. This paper presents the first Internet-scale measurement study of React2Shell exploitation activity using traffic collected from an Active Network Telescope. We developed a deterministic detection methodology that identifies exploitation attempts targeting endpoints implementing React Server components. It helped analyze exploitation traffic to characterize its temporal evolution, geographic and autonomous system-level distribution, and behavioral properties of the observed scanning activity. In addition, exploit payloads are examined to understand the attacker infrastructure and delivery mechanisms. The analysis reported rapid post-disclosure exploitation activity exhibiting patterns consistent with automated scanning campaigns, geographically distributed scanners, and concentrated backend infrastructure. To the best of our knowledge, this work provides the first quantitative characterization of React2Shell-triggered scanning activity, including the number of distinct scanners, their geographic and autonomous system distribution, and the scale of backend infrastructure involved in exploitation attempts.

Internet-Scale Measurement of React2Shell Exploitation Using an Active Network Telescope

Abstract

The increasing adoption of server-side component-based web frameworks has introduced new application-layer attack surfaces that remain insufficiently understood at Internet scale. On 3 December 2025, a critical remote code execution vulnerability (CVE-2025-55182) in React Server Components, referred to as React2Shell, was publicly disclosed and subsequently observed being exploited in the wild. Despite its critical severity and a CVSS base score of 10.0, there is limited empirical understanding of how this vulnerability is exploited across the Internet. This paper presents the first Internet-scale measurement study of React2Shell exploitation activity using traffic collected from an Active Network Telescope. We developed a deterministic detection methodology that identifies exploitation attempts targeting endpoints implementing React Server components. It helped analyze exploitation traffic to characterize its temporal evolution, geographic and autonomous system-level distribution, and behavioral properties of the observed scanning activity. In addition, exploit payloads are examined to understand the attacker infrastructure and delivery mechanisms. The analysis reported rapid post-disclosure exploitation activity exhibiting patterns consistent with automated scanning campaigns, geographically distributed scanners, and concentrated backend infrastructure. To the best of our knowledge, this work provides the first quantitative characterization of React2Shell-triggered scanning activity, including the number of distinct scanners, their geographic and autonomous system distribution, and the scale of backend infrastructure involved in exploitation attempts.
Paper Structure (20 sections, 7 figures, 1 table, 2 algorithms)

This paper contains 20 sections, 7 figures, 1 table, 2 algorithms.

Table of Contents

  1. Introduction
  2. Background and Related Work
  3. Internet-Scale Measurement of Vulnerability Exploitation
  4. Network Telescopes and Darknet-Based Threat Observation
  5. Incident Reports on React2Shell
  6. Security of Web Application Frameworks and Serialization Mechanisms
  7. Summary and Research Gap
  8. Proposed Framework
  9. Systamatic Pipline
  10. Active Network Telescope Infrastructure and Data Collection:
  11. Data Preprocessing and Structuring
  12. TCP Stream Reassembly and Connection Reconstruction
  13. Payload Decoding and Normalization
  14. React2Shell
  15. Exploit attempt detection and Signature extraction
  16. ...and 5 more sections

Figures (7)

  • Figure 1: Timeline of React2Shell (CVE-2025-55182) disclosure and exploitation events from November to December 2025.
  • Figure 2: End-to-end React2Shell detection pipeline ranging from ANT packet capture to connection-level exploit event identification.
  • Figure 3: Intensity of React2Shell exploit activity observed during December 2025. Inset: scatter plots with linear fits and corresponding Pearson correlation coefficients between the two vantage points.
  • Figure 4: Top five scanner countries and backend server countries involved in React2Shell activity, ranked by traffic share.
  • Figure 5: Backend server country infrastructure used by scanner countries.
  • ...and 2 more figures