CVE-2014-7205

This Metasploit module exploits an unauthenticated JavaScript injection vulnerability in the Bassmaster nodejs plugin for hapi. It leverages the batch endpoint to execute arbitrary JavaScript code via eval, leading to remote code execution.

This repository contains a Python-based PoC for CVE-2014-7205, exploiting a JavaScript injection vulnerability in Bassmaster to achieve Remote Code Execution (RCE). The exploit sends a crafted payload to the target's batch endpoint, injecting a NodeJS reverse shell or a netcat-based shell.

This repository contains a Python-based exploit for CVE-2014-7205, a Remote Code Execution (RCE) vulnerability in the Bassmaster NodeJS plugin. The exploit leverages improper input sanitization in the `eval()` function within `lib/batch.js` to execute arbitrary commands, including a reverse shell payload generated by `nodeshell.py`.

This Metasploit module exploits an unauthenticated JavaScript injection vulnerability in the bassmaster nodejs plugin for hapi, allowing remote code execution via the batch endpoint. It uses a crafted POST request to inject arbitrary JavaScript code, which then downloads and executes a payload from a controlled server.