Burp Suite\u2019s Scanning Arsenal Powered With Detection for Critical React2Shell Vulnerabilities
\n \t
\n
<\/BR>
\n
\n \t
\n
<\/BR><\/p>\n
PortSwigger has enhanced Burp Suite\u2019s scanning arsenal with the latest update to its ActiveScan++ extension, introducing detection for the critical React2Shell vulnerabilities (CVE-2025-55182<\/a> and CVE-2025-66478<\/a>).<\/p>\n This server-side request forgery (SSRF) flaw in React applications allows attackers to execute arbitrary shell commands, potentially leading to full remote code execution (RCE) on affected servers.<\/p>\n Security researchers and penetration testers can now identify these zero-day risks during routine scans, strengthening defenses against a vulnerability chain that has already surfaced in production environments.<\/p>\n ActiveScan++ builds on Burp Suite\u2019s active and passive scanning by adding low-overhead checks for advanced application behaviors. It detects subtle issues that evade standard scanners, such as host header manipulations, including password reset poisoning, cache poisoning, and DNS rebinding<\/a> attacks.<\/p>\n A significant addition is the coverage for high-profile CVEs, now including React2Shell along with well-known vulnerabilities like Shellshock and Log4Shell. Testers now benefit from Unicode bypass detection, triggered passive scans during fuzzing, and HTTP basic authentication insertion points.<\/p>\n