This session presents a structured, security-focused analysis of the React2Shell vulnerability as a real-world case study in insecure design and broken trust boundaries in modern frontend frameworks.
The talk begins by establishing a clear threat model for React and Next.js applications that use Server Components and Server Actions. We define the relevant trust zones, browser, framework runtime, and application server, and explicitly highlight where data crosses from untrusted client control into trusted server-side execution.
From there, we analyze the React2Shell CVE and its underlying root causes, including: - Implicit trust in framework-generated client invocations - Insufficient verification of serialized input crossing the client–server boundary - A blurred separation between data and executable intent
The session then examines the security fix, explaining how changes to validation and execution flow resolved the issue and which assumptions were corrected at the framework level.
Building on this analysis, the talk transitions into defensive standards and verification strategies that can help prevent similar classes of vulnerabilities. Using threat modeling and OWASP guidance, we map the issue to relevant OWASP ASVS controls, including: ASVS V1 – Architecture, Design, and Threat Modeling ASVS V4 – Access Control ASVS V5 – Input Validation and Processing ASVS V14 – Configuration
We conclude with practical defensive patterns applicable beyond React and Next.js, such as: - Treating framework-managed invocations as untrusted input - Applying defense-in-depth across client, framework, and server layers - Improving observability and logging for server-side execution paths - The role and limitations of WAFs in this class of vulnerability
Tools & Techniques Used - Conceptual architecture and trust-boundary diagrams - Framework execution-flow diagrams - Threat modeling techniques - OWASP ASVS and WSTG cross-referencing
Intended Audience This session is intended for: - Application Security engineers - Security architects - Developers involved in secure design reviews
