[New Rule] BBR - Potential React.JS CVE-2025-55182 Exploit Attempt

Fixes #5406

Author: terrancedejesus

rules_building_block/initial_access_react_server_components_rce_attempt.toml

@@ -0,0 +1,119 @@
+[metadata]
+bypass_bbr_timing = true
+creation_date = "2025/12/04"
+integration = ["network_traffic"]
+maturity = "production"
+updated_date = "2025/12/04"
+
+[rule]
+author = ["Elastic"]
+building_block_type = "default"
+description = """
+This rule detects potential exploitation attempts targeting CVE-2025-55182, a critical remote code execution
+vulnerability in React Server Components (RSC). The vulnerability exists in React versions 19.0.0 to 19.2.0 and Next.js
+versions prior to 15.1.3, allowing attackers to execute arbitrary code on the server by sending specially crafted RSC
+deserialization payloads.
+"""
+from = "now-9m"
+interval = "8m"
+language = "esql"
+license = "Elastic License v2"
+name = "Potential React Server Components RCE Attempt (CVE-2025-55182)"
+note = """## Triage and analysis
+
+### Investigating Potential React Server Components RCE Attempt (CVE-2025-55182)
+
+This rule detects potential exploitation attempts against CVE-2025-55182/CVE-2025-66478, a critical CVSS 10.0 vulnerability affecting React 19.0.0-19.2.0 and Next.js versions prior to 15.1.3. The vulnerability allows remote code execution through malformed React Server Component (RSC) deserialization payloads.
+
+### Possible investigation steps
+
+- Examine the full HTTP request body to identify the specific attack payload variant (constructor chain, __proto__ access, or malformed references).
+- Identify the target application and verify if it runs vulnerable React or Next.js versions.
+- Review the source IP for other reconnaissance or exploitation attempts against web applications.
+- Check if any proof-of-exploitation files were created on the server (common RCE validation technique).
+- Correlate with process execution logs to identify if child processes were spawned by the web server.
+
+### False positive analysis
+
+- Legitimate React Server Components traffic may contain `$ACTION_` patterns but should NOT contain `constructor`, `__proto__`, or malformed references like `$N:a:a` as property paths.
+- Developer testing or security scanning tools may trigger this rule during authorized penetration testing.
+- The combination of `$ACTION_REF` with prototype-related strings is a strong indicator of exploitation attempt.
+- Testing environments from tools such as [react2shell-scanner](https://github.com/assetnote/react2shell-scanner).
+
+### Response and remediation
+
+- Immediately update affected applications to patched versions
+- Block the source IP at the WAF/reverse proxy if exploitation is confirmed.
+- If HTTP 500 responses were observed, assume the vulnerable code path was triggered and investigate for potential compromise.
+- Review application logs for any evidence of successful code execution.
+- Consider implementing input validation for RSC payloads at the application layer.
+"""
+references = [
+    "https://www.wiz.io/blog/critical-vulnerability-in-react-cve-2025-55182",
+    "https://github.com/assetnote/react2shell-scanner",
+    "https://slcyber.io/research-center/high-fidelity-detection-mechanism-for-rsc-next-js-rce-cve-2025-55182-cve-2025-66478/",
+]
+risk_score = 47
+rule_id = "a8f7e9d4-3b2c-4d5e-8f1a-6c9b0e2d4a7f"
+severity = "medium"
+tags = [
+    "Domain: Network",
+    "Domain: Application",
+    "Domain: Web",
+    "Use Case: Threat Detection",
+    "Tactic: Initial Access",
+    "Tactic: Execution",
+    "Data Source: Network Packet Capture",
+    "Rule Type: BBR",
+    "Resources: Investigation Guide",
+]
+timestamp_override = "event.ingested"
+type = "esql"
+
+query = '''
+FROM logs-network_traffic.http-* metadata _id, _version, _index
+| WHERE http.request.method == "POST"
+    AND (
+        http.request.body.content LIKE "*$ACTION_REF*"
+        OR http.request.body.content LIKE "*$ACTION_*:*"
+    )
+    AND (
+        http.request.body.content LIKE "*constructor*"
+        OR http.request.body.content LIKE "*__proto__*"
+        OR http.request.body.content LIKE "*prototype*"
+        OR http.request.body.content RLIKE """\$\d+:[a-z]+:[a-z]+"""
+    )
+| KEEP *
+'''
+
+
+[[rule.threat]]
+framework = "MITRE ATT&CK"
+[[rule.threat.technique]]
+id = "T1190"
+name = "Exploit Public-Facing Application"
+reference = "https://attack.mitre.org/techniques/T1190/"
+
+
+[rule.threat.tactic]
+id = "TA0001"
+name = "Initial Access"
+reference = "https://attack.mitre.org/tactics/TA0001/"
+[[rule.threat]]
+framework = "MITRE ATT&CK"
+[[rule.threat.technique]]
+id = "T1059"
+name = "Command and Scripting Interpreter"
+reference = "https://attack.mitre.org/techniques/T1059/"
+[[rule.threat.technique.subtechnique]]
+id = "T1059.007"
+name = "JavaScript"
+reference = "https://attack.mitre.org/techniques/T1059/007/"
+
+
+
+[rule.threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+