Detects traceback indicators caused by the exploitation of the React Server Remote Code Execution Vulnerability (CVE-202

Hunt Hypothesis

This hunt hypothesis targets adversaries exploiting React Server Remote Code Execution vulnerabilities in Next.js applications to identify unique traceback indicators that signal active exploitation and potential command execution. Proactive hunting for these specific indicators within Azure Sentinel is critical to detect early-stage attacks before they escalate into full remote code execution compromises, ensuring timely response to emerging threats in modern web frameworks.

YARA Rule

rule EXPL_RCE_React_Server_Next_JS_CVE_2025_66478_Tracebacks_Dec25 {
   meta:
      description = "Detects traceback indicators caused by the exploitation of the React Server Remote Code Execution Vulnerability (CVE-2025-55182) in Next.js applications (CVE-2025-66478). This can also be caused by vulnerability scanning."
      author = "Florian Roth"
      reference = "Internal Research"
      date = "2025-12-05"
      score = 55
      id = "45d9b392-2237-590f-842f-27d549207a09"
   strings:
      $s1 = "Unexpected end of form"
      $s2 = "/next-server/app-page.runtime.dev.js:2:457"
      $s3 = "/app-page.runtime.dev.js:2:472"
   condition:
      all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

References

• Internal Research
• Source Rule

False Positive Guidance

Here are 3-5 specific false positive scenarios for the React Server Remote Code Execution Vulnerability detection rule, tailored for an enterprise environment:

• Automated CI/CD Pipeline Builds: Continuous Integration platforms like GitHub Actions, GitLab CI, or Jenkins often trigger automated build jobs that instantiate Next.js development servers to run unit tests. These internal builds frequently generate stack traces and error logs containing React Server keywords during the compilation phase, mimicking the exploitation signature of CVE-2025-66478.

  • Suggested Filter: Exclude traffic originating from known CI/CD runner IP ranges (e.g., 10.20.30.0/24) or filter out events where the User-Agent header contains identifiers like GitHub-Hookshot, Jenkins, or GitLab Runner.

• Scheduled Health Check Probes: Enterprise load balancers (such as AWS Application Load Balancer, NGINX Plus, or F5 BIG-IP) and external monitoring tools (Datadog, PagerDuty, New Relic) perform high-frequency health checks against Next.js endpoints. These probes often send requests that trigger the server to render a traceback response when checking for specific error states or during initial cold starts, generating false alerts.

  • Suggested Filter: Create an exclusion rule based on the X-Health-Check header presence or exclude traffic from specific monitoring IP addresses (e.g., Datadog Agent IPs) where the HTTP method is strictly GET and the response code is 200.

• Internal Admin Dashboard Refreshes: Internal administrative portals built on Next.js often utilize server-side rendering to display real-time metrics. When administrators perform bulk data exports or refresh complex dashboards via tools like Tableau embedded views or custom internal scripts, the React Server may generate