alert http any any -> any any (msg:"ATTACK [PTsecurity] React Server Components RCE (CVE-2025-55182)"; flow:established, to_server; pcre:"/(?:next-action|rsc-action-id)/Hi"; http.content_type; content:"multipart/form-data|3b 20|"; content:"boundary|3d|"; distance:0; http.request_body; content:"Content-Disposition|3a 20|"; content:"form-data|3b|"; distance:0; content:"|22|status|22|"; distance:0; pcre:"/\s*:\s*\x22resolved_model\x22/PR"; content:"Content-Disposition|3a 20|"; distance:0; content:"form-data|3b|"; distance:0; content:"|24 40|"; distance:0; reference:url, www.wiz.io/blog/critical-vulnerability-in-react-cve-2025-55182; reference:cve, 2025-55182; reference:url, rules.ptsecurity.com; classtype:attempted-admin; sid:10016007; rev:1;)