CVE-2019-12890

This exploit leverages missing authentication in RedwoodHQ's MongoDB instance to create an admin user by directly inserting a crafted document into the 'users' collection. It uses HMAC-MD5 for password hashing and requires no prior authentication.

This exploit leverages an unauthenticated MongoDB connection to create an admin user in RedwoodHQ by inserting a crafted document into the 'users' collection. It uses HMAC-MD5 for password hashing and directly interacts with the MongoDB instance.