Skip to content

Commit 4a8ac09

Browse files
updated descriptions
1 parent 5062dc6 commit 4a8ac09

File tree

1 file changed

+3
-4
lines changed

1 file changed

+3
-4
lines changed

rules_building_block/initial_access_react_server_components_rce_attempt.toml

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -10,9 +10,8 @@ author = ["Elastic"]
1010
building_block_type = "default"
1111
description = """
1212
This rule detects potential exploitation attempts targeting CVE-2025-55182, a critical remote code execution
13-
vulnerability in React Server Components (RSC). The vulnerability exists in React versions 19.0.0 to 19.2.0 and Next.js
14-
versions prior to 15.1.3, allowing attackers to execute arbitrary code on the server by sending specially crafted RSC
15-
deserialization payloads.
13+
vulnerability in React Server Components (RSC). The vulnerability allows attackers to execute arbitrary code on the
14+
server by sending specially crafted RSC deserialization payloads.
1615
"""
1716
from = "now-9m"
1817
interval = "8m"
@@ -23,7 +22,7 @@ note = """## Triage and analysis
2322
2423
### Investigating Potential React Server Components RCE Attempt (CVE-2025-55182)
2524
26-
This rule detects potential exploitation attempts against CVE-2025-55182/CVE-2025-66478, a critical CVSS 10.0 vulnerability affecting React 19.0.0-19.2.0 and Next.js versions prior to 15.1.3. The vulnerability allows remote code execution through malformed React Server Component (RSC) deserialization payloads.
25+
This rule detects potential exploitation attempts targeting CVE-2025-55182, a critical remote code execution vulnerability in React Server Components (RSC).
2726
2827
### Possible investigation steps
2928

0 commit comments

Comments
 (0)