CVE-2025-55182 취약점 위치

파일 :react-server-dom-webpack/cjs/react-server-dom-webpack-server.node.development.js
취약한 기능 : requireModule(v19.0.0의 ~2546-2558번째 줄)

function requireModule(metadata) {
  var moduleExports = __webpack_require__(metadata[0]);
  if (4 === metadata.length && "function" === typeof moduleExports.then)
    if ("fulfilled" === moduleExports.status)
      moduleExports = moduleExports.value;
    else throw moduleExports.reason;
  return "*" === metadata[2]
    ? moduleExports
    : "" === metadata[2]
      ? moduleExports.__esModule
        ? moduleExports.default
        : moduleExports
      : moduleExports[metadata[2]];  // VULNERABLE LINE
}

 

문제는 moduleExports[metadata[2]]이 대괄호 표기법 액세스가 자체 속성뿐만 아니라 프로토타입 체인도 확인한다는 것입니다.

 

코드 흐름 분석

HTTP POST /formaction
    ↓
decodeAction(formData, serverManifest)
    ↓
decodeBoundActionMetaData(body, serverManifest, formFieldPrefix)
    ↓
loadServerReference(serverManifest, value.id, value.bound)
    ↓
resolveServerReference(bundlerConfig, id)  // Parses module#export
    ↓
requireModule(metadata)  // VULNERABLE
    ↓
moduleExports[metadata[2]]  // Prototype chain access!