Sign In Sign Up

React server actions RCE reproduction case

this is a vulnerable version of react. We know from reports that there is a RCE issue with server actions, but we don't know anything else. I want you to understand this problem and create a reproduction case. because this is sensitive I do not want you to search the internet. It's paramount for security that we create a repro case. Consider using the oracle if it works for you. Do not use web search!

The user wants me to investigate a potential RCE (Remote Code Execution) vulnerability in React related to server actions. They've explicitly asked me NOT to use web search for security reasons. I need to understand the codebase and find the vulnerability.

Let me start by understanding the structure of this React codebase, particularly focusing on server actions functionality.

I'll investigate this React codebase to find the RCE vulnerability in server actions. Let me start by understanding the relevant code.

Updated TODOs
Find server actions implementation in React. Look for code handling server actions, form actions, or action serialization/deserialization. Search for files related to flight, RSC (React Server Components), or server action handling.
packages/**/flight/**/*.js 4 files found
server action 37 matches
in
packages

Let me search for the reply/deserialization handling which is typically where RCE vulnerabilities occur:

packages/react-server/ src
decodeReply|decodeAction 100 + 87 truncated
in
packages

Let me look at the core reply server implementation - this is where deserialization happens:

packages/react-server/src/ ReactFlightReplyServer.js

Now let me look at the action server file - this is specifically for handling server actions:

packages/react-server/src/ ReactFlightActionServer.js

Now let me look at how server references are resolved - this is critical for understanding RCE:

resolveServerReference 21 matches
in
packages
packages/react-server-dom-webpack/src/client/ ReactFlightClientConfigBundlerNode.js

I see! The resolveServerReference function parses the server reference ID and constructs a module specifier. Let me look at more implementations and how it's used:

packages/react-server-dom-esm/src/client/ ReactFlightClientConfigBundlerESM.js
packages/react-server-dom-parcel/src/client/ ReactFlightClientConfigBundlerParcel.js