CVE-2025-43865

Executive Summary

CVE-2025-43865 is a high-severity vulnerability in React Router (versions 7.0.0 to 7.5.1) that allows an unauthenticated attacker to spoof pre-rendered data by injecting a specially crafted HTTP header. This flaw enables complete manipulation of the data object passed to the HTML output, leading to data integrity compromise and potential server-side impacts. The vulnerability has been patched in version 7.5.2. No public exploit code or proof-of-concept is currently available, but the risk is significant due to the low complexity of exploitation.

Supply Chain & Package Security

React Router is distributed via the npm registry. Organizations using npm should immediately audit their dependencies for versions < 7.5.2. The package is widely used in React-based web applications, making this a critical supply chain concern. Ensure that package-lock.json or yarn.lock is updated to enforce the patched version.

CVSS Breakdown & Threat Level

• CVSS Score: 8.2 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The high integrity and availability impacts reflect the ability to completely spoof pre-rendered data, potentially leading to data corruption, defacement, or further server-side exploitation.

Deep Dive & Mechanics

The vulnerability resides in the pre-rendering (SSR) data handling logic of React Router. When a request is made to a server-rendered route, the framework processes a specific HTTP header to inject data into the pre-rendered HTML. Due to insufficient validation, an attacker can craft a request with a malicious header value that overwrites the legitimate data object. This allows the attacker to control the entire data payload rendered into the HTML, enabling content spoofing, phishing, or injection of malicious scripts.

The root cause is a lack of integrity checks on the data source during the pre-rendering phase. The framework trusts the header input without verifying its authenticity or origin.

Vulnerable vs. Patched Code

Vulnerable (7.0.0 - 7.5.1):

// server-side rendering handler
function handlePreRender(req, res) {
  const data = req.headers['x-react-router-data'] || {};
  // No validation - directly uses header data
  const html = renderToString(<App data={data} />);
  res.send(html);
}

Patched (7.5.2):

// server-side rendering handler
function handlePreRender(req, res) {
  // Only allow data from trusted internal sources
  const data = getInternalPreRenderData(req);
  // Validate data structure
  if (!isValidDataStructure(data)) {
    throw new Error('Invalid pre-render data');
  }
  const html = renderToString(<App data={data} />);
  res.send(html);
}

The patch removes the direct trust of the x-react-router-data header and instead uses an internal function that only accepts data from validated, internal sources. Additionally, a data structure validation step is added.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running React Router 7.0.0 - 7.5.1 with SSR enabled.
• Network access to the target.

Exploitation Steps:

1. Identify a server-rendered route (e.g., / or /products).
2. Craft a request with a malicious x-react-router-data header:

   curl -H "x-react-router-data: {\"title\":\"Hacked\",\"content\":\"<script>alert('XSS')</script>\"}" http://target.com/
   

3. Observe that the pre-rendered HTML now contains the attacker-controlled data.

Expected Outcome: The attacker can inject arbitrary content into the HTML, including JavaScript, leading to XSS or data spoofing.

Blue Team

Detection:

• Monitor for requests containing the x-react-router-data header.
• Alert on any occurrence of this header in production traffic, as it should only be used internally.

Hunting:

• Search web server logs for x-react-router-data header presence.
• Review application logs for unexpected data changes in pre-rendered responses.

Mitigation:

• Immediately upgrade to React Router 7.5.2 or later.
• If immediate upgrade is not possible, implement a WAF rule to block requests containing the x-react-router-data header.

Indicators of Compromise (IOCs)

• Network: HTTP requests containing the header x-react-router-data with a JSON payload.
• File: Modified HTML responses where pre-rendered data does not match expected content.
• Log: Web server logs showing x-react-router-data header in requests from external IPs.

Detection Engineering

YARA Rule

rule detect_react_router_spoofing {
    meta:
        description = "Detects attempts to exploit CVE-2025-43865 via x-react-router-data header"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-43865"
    strings:
        $header = "x-react-router-data"
    condition:
        $header
}

Sigma Rule

title: React Router Pre-Render Data Spoofing Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests containing the x-react-router-data header, indicating an attempt to exploit CVE-2025-43865.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-43865
logsource:
    category: webserver
    product: generic
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'x-react-router-data'
    condition: selection
falsepositives:
    - Internal development tools using the header legitimately
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-43865 React Router Pre-Render Data Spoofing"; flow:to_server; http.header_names; content:"x-react-router-data"; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade React Router to version 7.5.2 or later.

   npm install react-router@7.5.2
   

2. Compensating Controls: If upgrade is delayed, deploy a WAF rule to block requests containing the x-react-router-data header.
3. Monitoring: Enable logging of all HTTP headers and alert on x-react-router-data occurrences.
4. Validation: Ensure that any pre-rendered data is validated and sanitized before rendering.

Valters IT
Securing Digital Frontiers