.. / CVE-2022-29078

• RCE
• Nuclei
• Web

Exploit for Node.js Embedded JavaScript 3.1.6 - Template Injection (CVE-2022-29078)

Description:

Node.js Embedded JavaScript 3.1.6 is susceptible to server-side template injection via settings[view options][outputFunctionName], which is parsed as an internal option and overwrites the outputFunctionName option with an arbitrary OS command, which is then executed upon template compilation.

Nuclei Template

View the template here CVE-2022-29078.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2022/CVE-2022-29078.yaml

References: