CVE-2019-10758
CRITICAL KEV NUCLEImongo-express < 0.54.0 - Remote Code Execution via toBSON Method
Title source: llmExploitation Summary
CVE-2019-10758 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added December 10, 2021. EIP tracks 3 public exploits from researchers including masahiro331, lp008, dyeat. A Nuclei detection template is also available.
AI-analyzed exploit summary This repository contains a functional exploit for CVE-2019-10758, a remote code execution vulnerability in mongo-express. The exploit leverages prototype pollution to execute arbitrary commands via a crafted BSON payload.
Description
mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method. A misuse of the `vm` dependency to perform `exec` commands in a non-safe environment.
Exploits (3)
This repository contains a functional exploit for CVE-2019-10758, a remote code execution vulnerability in mongo-express. The exploit leverages prototype pollution to execute arbitrary commands via a crafted BSON payload.
This repository contains a functional exploit for CVE-2019-10758, a remote code execution vulnerability in mongo-express. The exploit uses prototype pollution to execute arbitrary commands via crafted POST requests, demonstrating a reverse shell payload.
The repository contains a functional Python script that exploits CVE-2019-10758, a remote code execution vulnerability in mongo-express. The exploit sends a crafted payload to the '/checkValid' endpoint, leveraging server-side JavaScript evaluation to execute arbitrary commands.
Nuclei Templates (1)
http.title:"Mongo Express" || http.title:"mongo express"
title="mongo express"
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H