mongoosejs/mongoose < 6.13.5 and >=8.0.0-rc0 <8.8.3 - Search Injection via $where in Match
Title source: llmExploitation Summary
CVE-2024-53900 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 3 public exploits from researchers including AikidoSec, www-spam, Gokul-Krishnan-V-R. A Nuclei detection template is also available.
AI-analyzed exploit summary This repository contains functional exploit PoCs for multiple CVEs, including a JavaScript injection vulnerability (AIKIDO-2026-10165) and a path traversal vulnerability (CVE-2014-3744). The PoCs demonstrate the vulnerabilities and validate that the Aikido Zen Firewall blocks them.
Description
Mongoose before 8.8.3 can improperly use $where in match, leading to search injection.
Exploits (3)
This repository contains functional exploit PoCs for multiple CVEs, including a JavaScript injection vulnerability (AIKIDO-2026-10165) and a path traversal vulnerability (CVE-2014-3744). The PoCs demonstrate the vulnerabilities and validate that the Aikido Zen Firewall blocks them.
This repository provides a functional PoC for CVE-2024-53900, demonstrating RCE in Mongoose < 8.8.3 via `populate().match` combined with `$where` injection. It includes a vulnerable Node.js app, automated exploit script, and Nuclei template for testing.
This repository contains a CTF challenge demonstrating CVE-2024-53900, a vulnerability in Mongoose that allows Remote Code Execution (RCE) due to improper use of the `$where` operator in MongoDB queries. The provided code includes a vulnerable Express.js server and a frontend for exploiting the vulnerability.
Nuclei Templates (1)
Server: Mongoose
References (5)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N