CVE-2014-7205

hapi Server Framework - Code Injection

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 4 public exploits for CVE-2014-7205. PoCs published by Metasploit, maximilianmarx, AndrewTrube, including Metasploit module exploits/multi/http/bassmaster_js_injection.

AI-analyzed exploit summary This Metasploit module exploits an unauthenticated JavaScript injection vulnerability in the Bassmaster nodejs plugin for hapi. It leverages the batch endpoint to execute arbitrary JavaScript code via eval, leading to remote code execution.

Description

Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for the hapi server framework for Node.js allows remote attackers to execute arbitrary Javascript code via unspecified vectors.

Exploits (4)

exploitdb WORKING POC VERIFIED
by Metasploit · rubyremotelinux
https://www.exploit-db.com/exploits/40689

This Metasploit module exploits an unauthenticated JavaScript injection vulnerability in the Bassmaster nodejs plugin for hapi. It leverages the batch endpoint to execute arbitrary JavaScript code via eval, leading to remote code execution.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Bassmaster <= 1.5.1
No auth needed
Prerequisites: Network access to the target server · Bassmaster batch endpoint exposed
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 3 stars
by maximilianmarx · poc
https://github.com/maximilianmarx/bassmaster-rce

This repository contains a Python-based PoC for CVE-2014-7205, exploiting a JavaScript injection vulnerability in Bassmaster to achieve Remote Code Execution (RCE). The exploit sends a crafted payload to the target's batch endpoint, injecting a NodeJS reverse shell or a netcat-based shell.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Bassmaster (NodeJS application)
No auth needed
Prerequisites: Target must be running a vulnerable version of Bassmaster · Attacker must have network access to the target's batch endpoint (port 8080) · Listener must be set up on the attacker's machine to receive the reverse shell
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC
by AndrewTrube · poc
https://github.com/AndrewTrube/CVE-2014-7205

This repository contains a Python-based exploit for CVE-2014-7205, a Remote Code Execution (RCE) vulnerability in the Bassmaster NodeJS plugin. The exploit leverages improper input sanitization in the `eval()` function within `lib/batch.js` to execute arbitrary commands, including a reverse shell payload generated by `nodeshell.py`.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Bassmaster NodeJS Plugin <= 1.5.1
No auth needed
Prerequisites: Target server running Bassmaster NodeJS Plugin <= 1.5.1 · Network access to the target server · Attacker-controlled listener for reverse shell
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit WORKING POC EXCELLENT
by mr_me <[email protected]>, Jarda Kotesovec · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/bassmaster_js_injection.rb

This Metasploit module exploits an unauthenticated JavaScript injection vulnerability in the bassmaster nodejs plugin for hapi, allowing remote code execution via the batch endpoint. It uses a crafted POST request to inject arbitrary JavaScript code, which then downloads and executes a payload from a controlled server.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Bassmaster nodejs plugin for hapi <= 1.5.1
No auth needed
Prerequisites: Network access to the target server · Target server running vulnerable version of bassmaster
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (6)

Core 6
Core References
Third Party Advisory x_refsource_misc
https://nodesecurity.io/advisories/bassmaster_js_injection
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2014/09/30/10
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/70180
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/96730
Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/40689/

Scores

EPSS 0.8424
EPSS Percentile 99.3%

Details

CWE
CWE-94
Status published
Products (2)
bassmaster_project/bassmaster < 1.5.2
npm/bassmaster 0 - 1.5.2npm
Published Oct 08, 2014
Tracked Since Feb 18, 2026