# PeerBlight Linux Backdoor Exploits React2Shell CVE-2025-55182

Unauthenticated RCE in React Server Components via Flight protocol deserialization lets attackers run code and deploy PeerBlight backdoor, CowTunnel, ZinFoq, and cryptominers.

- Payout: Real-world hack
- Severity: critical
- Program: React Server Components
- Credited: Huntress
- Disclosed: 2025-12-10
- CVE: CVE-2025-55182
- Write-up quality: 8/10
- Original: https://www.huntress.com/blog/peerblight-linux-backdoor-exploits-react2shell
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-peerblight-linux-backdoor-exploits-react2shell
- Tags: domain:web impact:mass-exploit impact:rce kind:incident platform:threat-intel sev:critical tech:nextjs tech:nodejs technique:source-review vuln:deserialization vuln:rce

**Target:** Next.js / React Server Components Flight protocol endpoint
**Root cause:** React Flight deserialization trusts attacker-supplied chunk state; a forged 'thenable' chunk with resolved_model status and a smuggled constructor in _formData.get is rehydrated and invoked, executing attacker code.
**Steps:**
1. Send crafted Flight payload with chunk 0 status `resolved_model` and a `then` method to make it thenable
2. Reference chunk via `$@` token; set `_formData.get` to resolve to a constructor
3. Use `$B` Blob hydration to force React to invoke the smuggled constructor
4. Set `_prefix` primitive to prepend code and append `//` to comment out trailing syntax
5. Observe command execution via `echo $((41*271))` probe, then download payloads via curl/wget | bash
**How found:** Huntress observed exploitation attempts across customer base starting Dec 4, 2025; log analysis revealed pre-exploitation scanning with Assetnote react2shell-scanner User-Agent, and consistent probes (echo $((41*271)), base64 test strings) indicated automated tooling.
**Exploitation:** Unauthenticated attacker sends one malicious HTTP request to a vulnerable Next.js/React Server Components endpoint; React Flight deserializes the forged chunk and executes the smuggled constructor, yielding RCE. Attackers then run discovery (whoami, hostname, ver||id), download shell scripts and ELF binaries (XMRig miner, PeerBlight, CowTunnel, ZinFoq) via curl/wget piped to bash, and establish persistence via systemd/Upstart services.
**Escalation:** Post-exploitation chained: cryptominer deployment, PeerBlight backdoor with DGA and BitTorrent DHT fallback C2, CowTunnel reverse proxy via FRP for pivoting (SOCKS5, TCP, HTTP, FTP, RDP), and ZinFoq Go implant with reverse shells and timestomping.
**Insight:** React Flight chunk state forgery (resolved_model + thenable) is a reusable deserialization primitive: look for frameworks that trust client-supplied lifecycle/status fields and rehydrate typed values like Blob/constructor references.