.. / CVE-2019-10758

Exploit for mongo-express Remote Code Execution (CVE-2019-10758)

Description:

mongo-express before 0.54.0 is vulnerable to remote code execution via endpoints that uses the toBSON method and misuse the vm dependency to perform exec commands in a non-safe environment.

Nuclei Template

View the template here CVE-2019-10758.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2019/CVE-2019-10758.yaml
Copy

References:

https://github.com/vulhub/vulhub/tree/master/mongo-express/CVE-2019-10758
https://github.com/CLincat/vulcat
https://github.com/MelanyRoob/Goby
https://nvd.nist.gov/vuln/detail/CVE-2019-10758
https://snyk.io/vuln/SNYK-JS-MONGOEXPRESS-473215