# CVE-2025-55182: Next.js React2Shell Exploited to Steal Cloud Secrets

> Attackers are exploiting the CVE-2025-55182 React2Shell vulnerability in Next.js to harvest AWS secrets, SSH keys, and database credentials from 766 hosts.

- Published: 2026-04-03T00:39:20.000Z
- Severity: high
- Category: Threat Intel
- Tags: CVE-2025-55182, Next Js, React2Shell, Cisco Talos, Credential Theft
- Author: Runtime Rebel Intel
- Primary source: https://thehackernews.com/2026/04/hackers-exploit-cve-2025-55182-to.html
- Canonical: https://runtimerebel.com/blog/cve-2025-55182-next-js-react2shell-exploited-to-steal-cloud-secrets

## Key points

- Threat actors are harvesting high-value cloud credentials and private keys from over 700 compromised environments.
- Web applications running vulnerable versions of Next.js susceptible to the React2Shell vulnerability are targeted.
- Organizations must immediately update Next.js instances and rotate all potentially exposed API keys and secrets.

A high-scale credential harvesting operation has surfaced, targeting organizations utilizing the Next.js framework. According to [The Hacker News](https://thehackernews.com/2026/04/hackers-exploit-cve-2025-55182-to.html), a threat cluster identified by Cisco Talos is actively exploiting a [CVE](/glossary#cve) identified as [CVE-2025-55182](/cve/cve-2025-55182), colloquially known as React2Shell. This campaign has successfully breached at least 766 Next.js hosts, focusing primarily on the exfiltration of sensitive secrets and administrative access keys.

## Technical Analysis of React2Shell

The React2Shell vulnerability represents a significant [RCE](/glossary#rce) risk within the Next.js ecosystem. The flaw resides in how the framework handles specific server-side rendering (SSR) processes, allowing an attacker to execute arbitrary commands on the underlying host. Once initial access is gained, the [TTP](/glossary#ttp) observed involve the immediate deployment of scripts designed to scan for and extract environment variables and configuration files.

Security researchers have noted that the attackers specifically target `.env` files, which often contain plaintext credentials for production databases and third-party services. By leveraging this vulnerability, the threat cluster can bypass traditional perimeter security measures to gain a foothold in cloud-native environments. This is not a localized threat but a broad-spectrum campaign aimed at any publicly accessible Next.js instance that has not been patched against this specific [Zero-Day](/glossary#zero-day) exploit.

## Credential Harvesting and Post-Exploitation

The scale of the theft is extensive. Evidence gathered from compromised hosts indicates the systematic removal of:

*   Amazon Web Services (AWS) access keys and secrets
*   SSH private keys from user directories
*   Stripe API keys and GitHub personal access tokens
*   Database connection strings and administrative credentials
*   Shell command history files (`.bash_history`, `.zsh_history`)

This data allows the attackers to achieve [Lateral Movement](/glossary#lateral-movement) across the victim's infrastructure. By obtaining SSH keys and AWS secrets, the threat cluster can move from the web application layer to the core infrastructure, potentially leading to full account takeovers or the deployment of [Ransomware](/glossary#ransomware). The [MITRE ATT&CK](/glossary#mitre-att-ck) framework would classify this behavior under Credential Access (T1003) and Unsecured Credentials (T1552).

### React2Shell Next.js Vulnerability Mitigation and Impact

For organizations running affected versions, immediate remediation is required. The first step is to apply the security patches provided by the Next.js maintainers to close the RCE vector. However, patching the vulnerability does not negate the risk of previously stolen credentials. If a host was compromised prior to patching, the [IoC](/glossary#ioc) may include unusual outbound traffic to unknown [C2](/glossary#c2) servers or the presence of unauthorized cron jobs.

Security teams should focus on **how to detect CVE-2025-55182 exploit** activity by auditing server logs for unusual POST requests targeting SSR endpoints. Furthermore, a complete rotation of all secrets stored on the affected hosts is mandatory. This includes resetting database passwords, regenerating AWS IAM keys, and revoking any GitHub tokens or Stripe keys that were accessible to the application environment. Monitoring for unauthorized API calls within cloud provider consoles can also help identify if stolen credentials are being actively utilized by the threat cluster.

**Related:** [QuickLens Chrome Extension Hijacked to Deploy ClickFix Malware](/blog/quicklens-chrome-extension-hijacked-to-deploy-clickfix-malware), [Storm-2561 Leverages SEO Poisoning for Credential Theft](/blog/storm-2561-leverages-seo-poisoning-for-credential-theft)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/cve-2025-55182-next-js-react2shell-exploited-to-steal-cloud-secrets