EXPL_RCE_React_Server_Next_JS_CVE_2025_66478_Errors_Dec25

rule EXPL_RCE_React_Server_Next_JS_CVE_2025_66478_Errors_Dec25 {
   meta:
      description = "Detects error messages caused by the exploitation of the React Server Remote Code Execution Vulnerability (CVE-2025-55182) in Next.js applications (CVE-2025-66478). This can also be caused by vulnerability scanning."
      author = "Florian Roth"
      reference = "https://github.com/Malayke/Next.js-RSC-RCE-Scanner-CVE-2025-66478"
      date = "2025-12-05"
      score = 65
      id = "6baeb522-6299-56a2-be27-21c6b668439b"
   strings:
      $s1 = "[Error: NEXT_REDIRECT]"
      $s2 = "digest: 'uid=0(root) gid=0(root)"
   condition:
      all of them
}