DAI-SS EXPLOIT CVE-2025-55182 Possible React Exploit RCE Attempt Inbound (child_process)

David Wharton@whartond

•updated Dec 6, 2025•4•1•247

This rule detects a possible Remote Code Execution (RCE) attempt targeting a React application, specifically exploiting CVE-2025-55182. It looks for inbound HTTP POST requests containing 'child_process' and 'response' and 'Sync' in the request body, along with specific HTTP headers ('Next-Action', 'rsc-action-id', or 'text/x-component'). The presence of 'child_process' suggests an attempt to execute system commands.