{"id":1016,"date":"2025-12-05T12:33:41","date_gmt":"2025-12-05T12:33:41","guid":{"rendered":"https:\/\/www.cert.hr\/novosti\/react2shell-ranjivost-cvss-10-hitno-azurirajte-ranjive-verzije\/"},"modified":"2026-11-04T09:02:43","modified_gmt":"2026-11-04T09:02:43","slug":"react2shell-ranjivost-cvss-10-hitno-azurirajte-ranjive-verzije","status":"publish","type":"post","link":"https:\/\/cert.hr\/en\/ranjivosti\/react2shell-ranjivost-cvss-10-hitno-azurirajte-ranjive-verzije\/","title":{"rendered":"React2Shell ranjivost (cvss 10). Hitno a\u017eurirajte ranjive verzije"},"content":{"rendered":"<p class=\"wp-block-paragraph\"><a href=\"https:\/\/react.dev\/blog\/2025\/12\/03\/critical-security-vulnerability-in-react-server-components\">Kriti\u010dna ranjivost, nazvana <strong>\"React2Shell\"<\/strong>, u <strong>React Server Components (RSC)<\/strong> <em>Flight<\/em> protokolu<\/a> omogu\u0107uje udaljeno izvr\u0161avanje k\u00f4da bez autentikacije u React i Next.js aplikacijama. Ranjivi su i svi okviri (<em>engl. frameworks<\/em>) i biblioteke koje koriste React.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Sigurnosni problem proizlazi iz <a href=\"https:\/\/wiki.hacknite.hr\/doku.php?id=deserializacija\">nesigurne deserializacije<\/a>. Dobio je ocjenu ozbiljnosti 10\/10 i dodijeljen mu je identifikator <strong><a href=\"https:\/\/cve.cert.hr\/cve\/CVE-2025-55182\">CVE-2025-55182<\/a><\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Sigurnosni istra\u017eiva\u010d <strong>Lachlan Davidson<\/strong> otkrio je propust i prijavio ga React timu 29. studenog. Utvrdio je da napada\u010d mo\u017ee posti\u0107i udaljeno izvr\u0161avanje k\u00f4da (RCE) slanjem posebno oblikovanog HTTP zahtjeva prema React Server Function krajnjim to\u010dkama (<em>engl. endpoints<\/em>).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\"\u010cak i ako va\u0161a aplikacija ne implementira nijednu krajnju to\u010dku za React Server Function, i dalje mo\u017ee biti ranjiva ako podr\u017eava React Server Components (RSC),\" upozorava React u sigurnosnom savjetu.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Sljede\u0107i paketi u svojoj zadanoj (<em>engl. default<\/em>) konfiguraciji su pogo\u0111eni:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>react-server-dom-parcel<\/strong><\/li><li><strong>react-server-dom-turbopack<\/strong><\/li><li><strong>react-server-dom-webpack<\/strong><\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">React je open-source JavaScript biblioteka za izgradnju korisni\u010dkih su\u010delja. Odr\u017eava ga Meta i \u0161iroko je usvojen me\u0111u organizacijama svih veli\u010dina za razvoj front-enda.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Next.js, koji odr\u017eava Vercel, je framework izgra\u0111en na Reactu koji dodaje server-side rendering, rutiranje i API krajnje to\u010dke.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Oba rje\u0161enja \u0161iroko su prisutna u cloud okru\u017eenjima kroz front-end aplikacije koje poma\u017eu u br\u017eem i lak\u0161em skaliranju i implementaciji arhitektura.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Utjecaj i zakrpe<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Prema Reactu, ranjivost je prisutna u verzijama <strong>19.0<\/strong>, <strong>19.1.0<\/strong>, <strong>19.1.1<\/strong> i <strong>19.2.0<\/strong>. Next.js je pogo\u0111en u eksperimentalnim <em>canary<\/em> izdanjima po\u010dev\u0161i od <strong>14.3.0-canary.77<\/strong>, te u svim izdanjima <strong>15.x<\/strong> i <strong>16.x<\/strong> prije zakrpanih verzija.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Propust postoji u paketu <strong>'react-server'<\/strong> koji koristi i React Server Components (RSC), a Next.js ga naslje\u0111uje kroz implementaciju RSC <em>Flight<\/em> protokola.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Ista ranjivost vjerojatno postoji i u drugim bibliotekama koje implementiraju React Server, uklju\u010duju\u0107i <strong>Vite RSC plugin<\/strong>, <strong>Parcel RSC plugin<\/strong>, <strong>React Router RSC preview<\/strong>, <strong>RedwoodSDK<\/strong> i <strong>Waku<\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Tehni\u010dke detelje ranjivostori mo\u017eete prona\u0107i na <a href=\"https:\/\/react2shell.com\/\">React2Shell web stranici<\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Preporu\u010dene radnje<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Programerima se <strong>strogo preporu\u010duje<\/strong> primjena zakrpa dostupnih u:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>React:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>19.0.1<\/li><li>19.1.2<\/li><li>19.2.1<\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Next.js:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>15.0.5<\/li><li>15.1.9<\/li><li>15.2.6<\/li><li>15.3.6<\/li><li>15.4.8<\/li><li>15.5.7<\/li><li>16.0.7<\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Organizacije bi trebale provjeriti svoja okru\u017eenja kako bi utvrdile koriste li ranjivu verziju te poduzeti odgovaraju\u0107e mjere za ubla\u017eavanje rizika.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Izvor: <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/critical-react2shell-flaw-in-react-nextjs-lets-hackers-run-javascript-code\/ \">https:\/\/www.bleepingcomputer.com\/news\/security\/critical-react2shell-flaw-in-react-nextjs-lets-hackers-run-javascript-code\/ <\/a><\/p>","protected":false},"excerpt":{"rendered":"<p>Kriti\u010dna ranjivost, nazvana &#8220;React2Shell&#8221;, u React Server Components (RSC) Flight protokolu omogu\u0107uje udaljeno izvr\u0161avanje k\u00f4da bez autentikacije u React i Next.js aplikacijama. Ranjivi su i svi okviri (engl. frameworks) i biblioteke koje koriste React. Sigurnosni problem proizlazi iz nesigurne deserializacije. Dobio je ocjenu ozbiljnosti 10\/10 i dodijeljen mu je identifikator CVE-2025-55182. Sigurnosni istra\u017eiva\u010d Lachlan Davidson [&hellip;]<\/p>\n","protected":false},"author":3,"featured_media":1615,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":[],"meta":{"_acf_changed":false,"footnotes":""},"categories":[27],"tags":[],"tema":[],"class_list":["post-1016","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ranjivosti"],"acf":[],"_links":{"self":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts\/1016","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/comments?post=1016"}],"version-history":[{"count":1,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts\/1016\/revisions"}],"predecessor-version":[{"id":1618,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts\/1016\/revisions\/1618"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/media\/1615"}],"wp:attachment":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/media?parent=1016"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/categories?post=1016"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/tags?post=1016"},{"taxonomy":"tema","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/tema?post=1016"},{"taxonomy":"format","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/format?post=1016"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}