Skip to main content

Security Advisory: Unauthenticated RCE (CVE-2025-55182) in largifysolutions.com

By


Security Advisory: Unauthenticated RCE (CVE-2025-55182) in largifysolutions.com


Date: March 07, 2026

Severity: Critical (CVSS 10.0)

Status: Un-Patched

Researcher: SkelerSecurity Research Team


Executive Summary

On March 6, 2026, SkelerSecurity identified a critical Remote Code Execution (RCE) vulnerability on the primary web property of Largify Solutions Limited (largifysolutions.com). The vulnerability stems from CVE-2025-55182, colloquially known as React2Shell, which affects specific versions of the React Server Components (RSC) Flight protocol.

Due to the presence of this flaw in the site's Next.js App Router implementation, an unauthenticated attacker could execute arbitrary code on the underlying Ubuntu server via crafted HTTP requests.



Technical Analysis

Vulnerability Context

CVE-2025-55182 is a failure in the secure deserialization of RSC payloads. In affected versions of the react-server-dom packages (19.0.0 – 19.2.0), the server-side logic responsible for hydrating components from serialized streams can be coerced into executing arbitrary JavaScript functions.

Observation & Proof of Concept (PoC)

During a proactive scan, SkelerSecurity identified the following indicators of vulnerability on the target host:

  • Endpoint Exposure: The application processed RSC-specific query parameters without sufficient validation.

  • Protocol Fingerprinting: Responses contained signature RSC markers (Vary: rsc, NEXT_REDIRECT) and specific Geist font-family chunking patterns consistent with a vulnerable Next.js deployment.

  • Execution Verification: A non-destructive, time-based blind payload confirmed the server was processing serialized instructions. Specifically, a base64-encoded execution marker was successfully injected into the RSC stream, confirming a path to RCE.

Note: Our testing was limited to "In-Process" verification. No shells were spawned, and no sensitive environment variables (e.g., .env secrets) were accessed.


Disclosure Timeline

In accordance with coordinated vulnerability disclosure (CVD) best practices, SkelerSecurity followed an accelerated timeline due to the "Known Exploited" status of this CVE.

DateAction
Mar 07, 2026 PKTInitial detection of vulnerable React Server Components version.
Mar 07, 04:30 PKTConfirmation of RCE via non-destructive PoC.
Mar 07, 09:00 PKTDirect Notification: Formal advisory sent to Largify Solutions management.
Mar 07, 11:30 PKTAcknowledgment: Site owners confirmed receipt and initiated emergency patching.
Mar 07, 18:00 PKTVerification: Public-facing endpoints confirmed as patched; Public Advisory released.


Remediation & Recommendations

For the Affected Party

Largify Solutions has successfully upgraded their production environment to react-server-dom-webpack@19.2.1+. We recommend a secondary audit of server logs for any suspicious POST or GET requests involving large RSC payloads dating back to December 2025.

For the Broader Community

Organizations utilizing Next.js 14/15 or React 19 must ensure they are not running vulnerable peer dependencies.

  1. Immediate Update: Ensure react-server-dom-webpack is version 19.2.1 or higher.

  2. Audit Dependencies: ```bash

    npm ls react-server-dom-webpack

  3. WAF Implementation: Deploy a Web Application Firewall rule to inspect and drop RSC payloads exceeding a reasonable character limit (e.g., 512–1024 characters) if they appear in URL query strings.


About SkelerSecurity

SkelerSecurity is a research-driven collective dedicated to the safety of the modern web. We believe in transparency, the "Patch First" philosophy, and supporting the developer community in securing the software supply chain.

Contact: alert@skelersecurity.com

Labels:

Comments

Post a Comment

Popular posts from this blog

DVWA CHEAT SHEET

By
“If you’re waiting for permission to break the system, you’re already too late.” What You’re Actually Dealing With DVWA isn’t random vulnerable code. It’s a deliberately broken system designed to teach how real applications fail — SQL injection, XSS, command execution, file inclusion, all of it ( edgenexus.io ) Multiple difficulty levels exist for one reason: To show you how weak defenses evolve into real ones. 0. Core Principle You don’t memorize payloads. You understand flow. Input → Application Logic → Output If you control input, you control logic. If you control logic, the rest is just execution. 1. SQL Injection “You don’t bypass authentication. You redefine it.” Break the query ' Error means the application is exposing its internal structure. Take control ' OR '1'='1 # You’re not logging in. You’re forcing the query to return true. Map columns ' ORDER BY 1-- ' ORDER BY 2-- You’re learning how the database thinks. Extract data ' UNION SELECT datab...
Post a Comment
Read more

Greed - Kinnaird CTF

By
Greed Challenge — RSA Low-Exponent Write-Up Overview This challenge revolves around a classic RSA weakness: using a small public exponent (e = 3) without proper padding . Under the right conditions, this allows direct recovery of the plaintext by taking an integer cube root of the ciphertext. The task is to identify the real encrypted flag among several decoys and exploit this mathematical flaw. Key Observations RSA Parameters Public exponent: e = 3 (Narratively hinted as the warden’s “three kingdoms”) Modulus size: ~254 bits Candidate ciphertext: 0x1aadb93ce9a5704a83345e00 Critical Hint “Sometimes the treasure is so light that it never touches the vault walls.” This implies the plaintext m is small enough that: m³ < N When this happens, RSA encryption becomes: c = m³ instead of: c = m³ mod N No modular reduction occurs — which is exactly what enables the attack. Cryptographic Background RSA encryption is defined as: c = m^e mod N If m^e < N , then: c = m^e For e = 3 , recove...
Post a Comment
Read more

Pride - Kinnaird CTF

By
Writeup: Pride Challenge (Reverse Engineering) Challenge Overview Pride is a multi-layered Windows reverse engineering challenge. It requires the researcher to navigate through a protective "shell" ( UPX ), bypass environmental checks ( Anti-Debugging/Anti-VM ), and eventually reverse-engineer a custom Virtual Machine (VM) architecture to extract the hidden flag fragment. 1. Initial Analysis & Unpacking The binary initially presents a decoy flag. Analysis with PEiD or Detect It Easy (DIE) reveals the executable is compressed with UPX . Manual Unpacking While a standard upx -d pride.exe is the first step, this challenge utilizes a modified UPX header . To unpack manually: Load the binary in x64dbg . Look for the POPAD instruction followed by a large JMP —this is the jump to the Original Entry Point (OEP) . Use Scylla to dump the process and fix the IAT ( Import Address Table ). 2. Anti-Analysis Bypassing Once unpacked, the binary performs several checks to ensure it...
Post a Comment
Read more