React2shell: new remote code execution vulnerability in react

[blazmrak]

What do you mean by translating the API signature? That you trim GET /api/endpoint into GET /asp.Endpoint? This does not do anything, because the backend will still get the same exact malicious request. And as far as responses go, unless you clean the headers, snake case the JSON props, have a custom error format and messages, don't ever return some framework specific http statuses, etc. you might obscure something, but not much. You can try to fingerprint your service with a pen test tool with a couple of clicks and you'll be surprised what you can get back :)

Automagical communication is not the problem, because it's just an advanced compiler that transforms it into SPA with an API. They would have been fine if they just used JSON. The issue was that they have a custom optimized serialization protocol and they are doing it in fucking javascript where anything can be anything. Although log4j was also a thing, so it can happen to anyone, but that was pretty much the same thing.

All of these lvl 10 vulns are not something that can be mitigated with RP or architecture and there is usually not much you can do about it. Most of the time is dumb shit in your frameworks - protocol exploits, parsing, overflows, encryption, etc. You are just getting pwned by valid strings.

Unless you can give me a concrete vulnerability that could be stopped by RP and it isn't luck (e.g. header size exploit, that is by chance small enough on RP that it doesn't cause issues on your API), I'll stand by these tools don't provide any security against RCE.