EXPL_RCE_React_Server_CVE_2025_55182_POC_Dec25

rule EXPL_RCE_React_Server_CVE_2025_55182_POC_Dec25 {
   meta:
      description = "Detects RCE indicators related to the proof-of-concept code for the React Server Remote Code Execution Vulnerability (CVE-2025-55182)"
      author = "Florian Roth"
      reference = "https://www.youtube.com/watch?v=MmdwakT-Ve8"
      date = "2025-12-05"
      score = 70
      id = "fdd661a9-0532-5246-b744-0c1a9632d1cd"
   strings:
      $s1 = "process.mainModule.require('child_process').execSync("
      $s2 = "$1:constructor:constructor"
   condition:
      all of them
      // not XML
      and not uint16(0) == 0x3c3f
}