Within hours of the public disclosure of CVE-2025-55182, known as React2Shell, on December 3, multiple China-linked threat groups began exploiting the flaw in live environments.
Amazon’s threat intelligence teams detected exploitation attempts by state-nexus actors, including Earth Lamia and Jackpot Panda, through its MadPot honeypot infrastructure.
The critical vulnerability, rated CVSS 10.0, allows unauthenticated remote code execution in React Server Components used in React 19.x and Next.js 15.x/16.x (App Router).
Discovered by researcher Lachlan Davidson and responsibly disclosed to the React Team on November 29, React2Shell stems from unsafe deserialization in React Server Components.
Applications supporting these components are vulnerable even if they do not explicitly use server functions, a design factor that significantly widens the potential attack surface.
While AWS services are not affected, organizations hosting React or Next.js on EC2 or containerized environments must apply updates immediately.
China-Nexus Activity and Attack Techniques
According to AWS, observed exploit attempts originated primarily from IP infrastructure associated with Chinese threat groups.
Earth Lamia, previously known for targeting financial and government organizations in Asia, and Jackpot Panda, which focuses on regional intelligence collection, were among the actors rapidly operationalizing PoCs after disclosure.
Shared anonymization networks used by multiple threat clusters continue to complicate definitive attribution.
Attackers rely on both automated scanning tools and public proof-of-concept exploits, many of which are flawed or incomplete. Despite their limitations, these tools enable broad and noisy exploitation attempts.
In several incidents, actors executed system commands such as whoami and id, or attempted to write files to/tmp/pwned.txt and read /etc/passwd, indicating attempts to test successful command execution rather than fully developed post-exploitation phases.
An unattributed actor linked to IP 183[.]6.80.214 conducted 116 probing requests in one hour, evidence of manual fine-tuning during exploitation.
AWS deployed multiple layers of defenses, including Sonaris Active Defense, the AWS WAF Managed Rules (version 1.24 or higher), and real-time monitoring via MadPot.
These measures automatically detect and block exploit attempts, though AWS emphasizes that “protections are not substitutes for patching.”
The company’s ongoing analysis also revealed that many attackers simultaneously target other recent vulnerabilities, such as CVE-2025-1338, highlighting China-based groups’ systematic approach to large-scale vulnerability exploitation.
AWS advises users to update vulnerable frameworks, deploy WAF custom rules, and audit logs for suspicious POST requests containing next-action or rsc-action-id headers.
Indicators of compromise include unusual command execution, new Node.js child processes, and suspicious file activity in /tmp/.
The React2Shell incident underscores the speed and coordination of Chinese state-linked threat activity, where the window between vulnerability disclosure and exploitation continues to close rapidly.
Find this Story Interesting! Follow us on Google News , LinkedIn and X to Get More Instant Updates
