Description

React Router allows a DoS via cache poisoning by forcing SPA mode

Summary

After some research, it turns out that it is possible to force an application to switch to SPA mode by adding a header to the request. If the application uses SSR and is forced to switch to SPA, this causes an error that completely corrupts the page. If a cache system is in place, this allows the response containing the error to be cached, resulting in a cache poisoning that strongly impacts the availability of the application.

Details

The vulnerable header is X-React-Router-SPA-Mode; adding it to a request sent to a page/endpoint using a loader throws an error. Here is the vulnerable code :

To use the header, React-router must be used in Framework mode, and for the attack to be possible the target page must use a loader.

Steps to reproduce

Versions used for our PoC:

"@react-router/node": "^7.5.0",

"@react-router/serve": "^7.5.0",

"react": "^19.0.0"

"react-dom": "^19.0.0"

"react-router": "^7.5.0"

Install React-Router with its default configuration in Framework mode (https://reactrouter.com/start/framework/installation)

Add a simple page using a loader (example: routes/ssr)

Send a request to the endpoint using the loader (/ssr in our case) adding the following header:

X-React-Router-SPA-Mode: yes

Notice the difference between a request with and without the header;

Normal request

With the header

Impact

If a system cache is in place, it is possible to poison the response by completely altering its content (by an error message), strongly impacting its availability, making the latter impractical via a cache-poisoning attack.

Credits

Rachid Allam (zhero;)

Yasser Allam (inzo_)

Mitigation

Aliases

References