React Router 在 Action/Server Action 请求处理中存在 CSRF 问题

攻击者可以利用此 CSRF 漏洞，通过伪造用户的请求，在用户不知情的情况下执行恶意操作。例如，攻击者可以修改用户数据、更改配置设置或执行其他敏感操作。由于该漏洞影响服务器端路由处理程序，攻击者可能能够绕过客户端安全措施，从而造成更严重的后果。该漏洞的潜在影响包括数据泄露、服务中断和未经授权的访问。

Applications built with React Router (or Remix v2) that utilize server-side route action handlers in Framework Mode, or React Server Actions in unstable RSC modes, are at risk. This includes applications that handle sensitive data or perform critical actions via POST requests. Developers using older versions of React Router and relying on Declarative or Data Mode are not directly affected.

• nodejs: Monitor application logs for unusual POST requests to UI routes, especially those originating from external sources.

grep -i 'POST /ui/route' access.log

• nodejs: Check for any unauthorized modifications to data or user accounts that could be attributed to CSRF attacks.

# Review audit logs for suspicious activity
journalctl -u your-app -g 'CSRF attack'

• generic web: Inspect response headers for unexpected redirects or changes in application state after a user visits a potentially malicious link. Use curl to test endpoints.

curl -v https://your-app.com/ui/route

1. 2026-01-08Disclosure

   disclosure

1. 已保留2026-01-05
2. 发布日期2026-01-08
3. 修改日期2026-02-03
4. EPSS 更新日期2026-03-23

最有效的缓解措施是升级到 react-router 7.12.0 或更高版本。如果无法立即升级，可以考虑实施以下临时缓解措施：在所有关键路由上实施 CSRF 保护机制，例如使用 CSRF 令牌。审查并加强服务器端路由处理程序的输入验证和授权逻辑。使用 Web 应用防火墙 (WAF) 来检测和阻止可疑的 CSRF 请求。在升级后，请验证 CSRF 保护机制是否正常工作，并确保所有关键路由都受到保护。