💻 computer science

Internet-Scale Measurement of React2Shell Exploitation Using an Active Network Telescope

This paper presents the first Internet-scale measurement study of the critical React2Shell (CVE-2025-55182) vulnerability, utilizing an Active Network Telescope to quantitatively characterize the rapid, automated, and geographically distributed scanning campaigns and attacker infrastructure observed immediately following its disclosure.

Original authors: Aakash Singh, Kuldeep Singh Yadav, Md Talib Hasan Ansari, V. Anil Kumar

Published 2026-03-16

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Aakash Singh, Kuldeep Singh Yadav, Md Talib Hasan Ansari, V. Anil Kumar

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine the internet as a giant, bustling city where every building (website) has a front door. Most of these doors are locked, but some have a very specific, hidden flaw in their locking mechanism.

This paper is a report from a team of digital detectives who set up a high-tech "trap house" to watch how criminals try to break into these buildings once they learn about the flaw.

Here is the story of React2Shell, explained simply:

1. The Flaw: A Broken Lock in the "Magic Door"

Modern websites often use a special construction kit called React Server Components. Think of this as a "Magic Door" that lets the building's owner (the server) and the visitor (your browser) talk to each other instantly.

On December 3, 2025, a critical flaw was discovered in this Magic Door, named React2Shell (CVE-2025-55182).

The Problem: The door was too trusting. If a visitor whispered a specific, tricky code phrase (involving "prototypes" and "constructors" in computer speak), the door wouldn't just open; it would hand the visitor the keys to the entire building's basement, allowing them to do whatever they wanted.
The Danger: This was rated a 10/10 on the danger scale. It meant hackers could take over servers instantly.

2. The Trap: The "Active Network Telescope"

Usually, security researchers just sit back and watch traffic pass by (like watching cars drive down a street). But here's the problem: if a car doesn't stop, you can't see what's in the trunk.

The researchers built something smarter called an Active Network Telescope.

The Analogy: Imagine a fake house with a "Do Not Disturb" sign, but the doorbell actually works. When a burglar rings the bell, instead of ignoring them, the house says, "Hello! Come on in!" and opens the door.
The Result: This allowed the researchers to let the hackers in just enough to see exactly what they were trying to steal and where they were coming from, without actually letting them damage real buildings.

3. The Investigation: What They Saw

Once the flaw was announced to the public, the researchers watched their "trap house" for a month. Here is what they found:

The Rush: As soon as the news broke, the hackers didn't wait. Within hours, automated robots (scanners) started knocking on every door in the city. It was like a stampede.
The Scanners (The Burglars):
- They came from all over the world, but a huge chunk came from The Netherlands, Poland, and the US.
- They weren't just guessing; they were using scripts to knock on specific doors (ports 80, 443, 3000, etc.) over and over again.
The Hideouts (The Backend):
- Here is the twist: While the burglars were scattered all over the globe, the safe houses they were trying to reach were very concentrated.
- Most of the "command centers" (servers) were hidden in just a few countries, primarily The Netherlands and Tunisia.
- The Metaphor: It's like having a thousand burglars running around the world, but they are all taking orders from just three phone booths in two specific cities.

4. The "Magic Words" (The Payload)

The researchers analyzed the actual messages the hackers sent. They found a specific "signature" or "fingerprint" that proved it was a React2Shell attack.

The hackers were using a very specific sequence of "magic words" (like __proto__ and constructor) to trick the Magic Door.
The researchers created a filter to spot these exact words. If a message had all three of these weird words together, they knew, "Aha! That's a React2Shell attack!"

5. The Big Takeaways

Speed is Key: Once a vulnerability is public, the "bad guys" move incredibly fast. The window of safety is tiny.
The Asymmetry: The attackers are everywhere (distributed), but their infrastructure is surprisingly small and centralized. If you could block those few central servers, you could stop a massive amount of attacks.
Automation: This wasn't a few clever hackers sitting in a basement. It was massive, automated robots scanning the entire internet, looking for anyone who hadn't fixed their lock yet.

In Summary

This paper is a map of a digital heist. It shows us that when a critical lock is broken in a popular system, the internet gets flooded with automated thieves. However, by watching their "trap house," the researchers learned that while the thieves are everywhere, their headquarters are actually quite small and easy to find if you know where to look.

The lesson for everyone: Fix your locks immediately when a warning comes out, because the robots are already at your door.

1. Problem Statement

The paper addresses the lack of empirical, Internet-scale understanding regarding the exploitation of React2Shell (CVE-2025-55182), a critical Remote Code Execution (RCE) vulnerability in React Server Components (RSC).

Vulnerability Context: Disclosed on December 3, 2025, with a CVSS score of 10.0, the flaw stems from insecure deserialization in the React Flight Protocol. It allows unauthenticated attackers to traverse the JavaScript prototype chain (__proto__ $\to$ constructor $\to$ Function) to execute arbitrary code on the server.
Research Gap: While industry reports confirmed active exploitation, there were no peer-reviewed studies characterizing the temporal evolution, geographic distribution, autonomous system (AS) dynamics, or payload structures of these attacks at an Internet scale.
Methodological Limitation: Traditional Passive Network Telescopes (darknets) are insufficient for this specific threat because they cannot capture application-layer payloads. Since React2Shell exploits occur over TCP, passive telescopes only see SYN packets (connection requests) but miss the actual malicious payload because the telescope does not respond with a SYN/ACK to complete the handshake.

2. Methodology

The authors developed a novel measurement framework using an Active Network Telescope (ANT) to overcome the limitations of passive observation.

A. Active Network Telescope (ANT) Infrastructure

Mechanism: Unlike passive telescopes, the ANT actively responds to incoming TCP SYN packets with SYN/ACK packets. This establishes a full TCP connection, allowing the telescope to capture the initial payload (up to the initial congestion window) sent by the attacker.
Deployment: Two vantage points were used:
- VP1: Monitors a /23 block (511 IPs) in India.
- VP2: Monitors a /25 block (124 IPs) in a physically distinct location.
Data Collection: The system captures full packet traces (headers and payloads) for a fixed 5-second interval per connection, storing them in PCAP format and processing them via a High-Performance Computing (HPC) platform.

B. Detection Pipeline

The authors designed a deterministic, protocol-aware detection pipeline:

Stream Reassembly: Reconstructs TCP flows from raw packets, handling retransmissions and ordering.
Payload Decoding & Normalization: Applies a fixed sequence of decoders (UTF-8, Latin-1, URL, Base64, gzip, zlib, etc.) to normalize obfuscated payloads.
Signature Extraction: A conjunctive signature identifies React2Shell attempts based on three simultaneous structural indicators within the decoded payload:
- Explicit reference to __proto__ (prototype traversal).
- Chained reference to constructor (accessing the Function constructor).
- Presence of React Flight reference tokens (e.g., $d+:), confirming the payload is part of the RSC serialization context.

3. Key Contributions

First Internet-Scale Characterization: Provides the first quantitative analysis of React2Shell exploitation, including scanner counts, geographic distribution, and backend infrastructure scale.
Active Telemetry Framework: Demonstrates the efficacy of Active Network Telescopes in capturing application-layer exploit payloads for TCP-based vulnerabilities, a capability previously limited in darknet research.
Deterministic Detection: Introduces a signature-based methodology that minimizes false positives by requiring the co-occurrence of specific prototype-chain manipulation artifacts within the React Flight context.
Infrastructure Asymmetry Analysis: Reveals a structural separation between widely distributed scanning sources and highly concentrated backend exploitation infrastructure.

4. Key Results & Findings

A. Temporal Evolution

Onset: Exploitation activity began immediately after public disclosure (Dec 3, 2025), with the first observed packet on December 5, 2025.
Correlation: Data from VP1 and VP2 showed a strong temporal correlation ( $r = 0.87$ ), confirming a coordinated, Internet-wide campaign rather than isolated noise.
Intensity: Activity escalated rapidly, peaking on December 19, 2025, with VP1 recording ~88,000 exploit-related connections in a single day.

B. Geographic and AS Distribution

Scanner Origins: Scanners were geographically diverse. The top source countries were the Netherlands (37.1%), Poland (30.1%), and USA (16.8%).
Backend Concentration: In stark contrast to the distributed scanners, the backend infrastructure (servers embedded in exploit payloads) was highly concentrated. 62.6% of backend traffic resolved to servers in the Netherlands, followed by Tunisia (26.1%).
Asymmetry: While scanning sources spanned many Autonomous Systems (ASNs), the backend infrastructure relied on a small, reusable set of server IPs and ASNs.

C. Scanner Behavior

Automation: The scanning behavior was systematic and exhaustive. A small subset of scanners contacted all monitored destination IPs, while the majority (75%) contacted fewer than 215 IPs.
Port Targeting: Attacks focused heavily on web-facing ports, specifically 80, 443, 3000, 3001, 3002, and 8080, indicating a targeted search for Next.js and React-based applications.
Payload Structure: Exploit payloads overwhelmingly used direct IP addresses for backend redirection rather than domain names, suggesting a reliance on IP-based infrastructure that is difficult to mitigate via DNS blocking.

5. Significance

Security Awareness: The study highlights the speed at which critical framework vulnerabilities are weaponized (days from disclosure to widespread exploitation) and the necessity of rapid patch management.
Defensive Strategy: The findings suggest that defensive efforts should prioritize backend infrastructure mitigation (blocking the concentrated server IPs) rather than attempting to block the widely distributed and ephemeral scanning sources.
Methodological Advancement: The paper validates the use of Active Network Telescopes as a critical tool for studying modern, TCP-based application-layer attacks, filling a gap left by passive observation methods.
Policy Impact: The rapid escalation of React2Shell led to its inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog, and this study provides the empirical data supporting such urgent regulatory actions.