Admins and defenders gird themselves against maximum-severity server vuln

Security defenders are girding themselves in response to the disclosure of a maximum-severity vulnerability disclosed Wednesday in React Server, an open-source package that’s widely used by websites and in cloud environments.

The vulnerability is easy to exploit and allows hackers to execute malicious code on servers that run it. Exploit code is now publicly available.

React is embedded into web apps running on servers so that remote devices render JavaScript and content more quickly and with fewer resources required. React is used by an estimated 6 percent of all websites and 39 percent of cloud environments. When end users reload a page, React allows servers to re-render only parts that have changed, a feature that drastically speeds up performance and lowers the computing resources required by the server.

A perfect 10

Security firm Wiz said exploitation requires only a single HTTP request and had a “near-100% reliability” in its testing. Multiple software frameworks and libraries embed React implementations by default. As a result, even when apps don’t explicitly make use of React functionality, they can still be vulnerable, since the integration layer itself invokes the buggy code.

The combination of the widespread use of React—particularly in cloud environments—the ease of exploitation, and the ability to execute code that gives attackers control of servers has earned the vulnerability a severity rating of 10, the highest score possible. On social media, security defenders and software engineers urged anyone responsible for React-related apps to immediately install an update released Wednesday.