nodejshell

NODEJSHELL - NodeJs 역직렬화deserialization를 위한 리버스 셸 익스플로잇 CVE-2017-5941 이 익스플로잇은 십진수decimal로 인코딩된 후 base64로 인코딩되는 리버스 셸 페이로드를 자동으로 생성합니다. 그 후 이 페이로드는 사용자 입력을 직렬화serialize하고 쿠키에 저장하는 http POST 요청을 통해 전송됩니다. 그런 다음 GET 요청을 통해 접근하여 RCE를 획득합니다. 사용 방법: python3 nodejshell.py lhost : 로컬 IP 주소 lport : 리버스 셸...

CVE-2017-5941-NodeJS-RCE

CVE-2017-5941-NodeJS-RCE https://paper.seebug.org/213/...

RCE-NodeJs

node-serialize — CVE-2017-5941 참고: 이 문서는 오직 방어 및 교육 목적으로 작성되었습니다. 익스플로잇이나 RCE원격 코드 실행 제작에 관한 지침은 포함되어 있지 않습니다. 요약: node-serialize 0.0.4 및 유사한 구버전은 신뢰할 수 없는 역직렬화로 인해 위험을 초래할 수 있습니다 — 수신 데이터를 unserialize로 처리하기 전에 항상 검증하십시오. 탐지: 코드에서 serialize.unserialize 또는 node-serialize 존재 여부를 확인하십시오. 디코딩된 base64...

CVE-2017-5941

creationtimestamp| type| source ---|---|--- 2025-10-12 15:00:06+00:00| published-proof-of-concept| Telegram/nHH3EPNLC7cR6YqxoW514LvTLwhWMDWIdjARrLyJXH8zbM 2026-07-29 12:00:32+00:00| seen| https://t.me/CVEhub/12576 2026-07-30 00:00:57+00:00| seen| https://t.me/CVEhub/12576 2026-07-31 00:00:08+00:0...

Node.JS - 'node-serialize' Remote Code Execution (3)

Exploit Title: Node.JS - 'node-serialize' Remote Code Execution 3 Date: 17.06.2021 Exploit Author: Beren Kuday GORUN Vendor Homepage: https://github.com/luin/serialize Software Link: https://github.com/luin/serialize Version: 0.0.4 Tested on: Windows & Ubuntu CVE : 2017-5941 var serialize =...

Node.JS Remote Code Execution

Exploit Title: Node.JS - 'node-serialize' Remote Code Execution 3 Date: 17.06.2021 Exploit Author: Beren Kuday GORUN Vendor Homepage: https://github.com/luin/serialize Software Link: https://github.com/luin/serialize Version: 0.0.4 Tested on: Windows & Ubuntu CVE : 2017-5941 var serialize =...

Node.JS - (node-serialize) Remote Code Execution Exploit (3)

Exploit Title: Node.JS - 'node-serialize' Remote Code Execution 3 Exploit Author: Beren Kuday GORUN Vendor Homepage: https://github.com/luin/serialize Software Link: https://github.com/luin/serialize Version: 0.0.4 Tested on: Windows & Ubuntu CVE : 2017-5941 var serialize = require'node-serialize...

Node.js Remote Code Execution (CVE-2017-5941)

A remote code execution vulnerability exists in Node.js. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Node.JS Remote Code Execution

Exploit Title: Node.JS - 'node-serialize' Remote Code Execution 2 Exploit Author: UndeadLarva Software Link: https://www.npmjs.com/package/node-serialize Version: 0.0.4 CVE: CVE-2017-5941 import requests import re import base64 import sys url = 'http://192.168.100.133:8000/' change this payload =...

Node.JS - 'node-serialize' Remote Code Execution (2)

Exploit Title: Node.JS - 'node-serialize' Remote Code Execution 2 Exploit Author: UndeadLarva Software Link: https://www.npmjs.com/package/node-serialize Version: 0.0.4 CVE: CVE-2017-5941 import requests import re import base64 import sys url = 'http://192.168.100.133:8000/' change this payload =...

logostech.net Cross Site Scripting vulnerability OBB-1192798

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

asics.com Cross Site Scripting vulnerability

Security Researcher Tech4 Helped patch 28 vulnerabilities Received 1 Coordinated Disclosure badges Received 1 recommendations , a holder of 1 badges for responsible and coordinated disclosure, found a security vulnerability affecting asics.com website and its users. Following coordinated and...

@contrast/loopback-test-bench (3.15.0), @contrast/test-bench-utils (>=2.7.0, <=3.38.0) +34 more potentially affected by CVE-2017-5941 via node-serialize (>=0.0.3, <=0.0.4)

node-serialize NPM version =0.0.3, =2.7.0, =1.1.0, =1.0.1, =1.0.0, =1.1.1, =1.0.0, =1.0.4, =1.0.0, =1.0.0, =0.0.1, =1.0.4 and more Source cves: CVE-2017-5941 Source advisory: OSV:GHSA-Q4V7-4RHW-9HQM...

CVE-2017-5941

An issue was discovered in the node-serialize package 0.0.4 for Node.js. Untrusted data passed into the unserialize function can be exploited to achieve arbitrary code execution by passing a JavaScript Object with an Immediately Invoked Function Expression IIFE...

CVE-2017-5941

An issue was discovered in the node-serialize package 0.0.4 for Node.js. Untrusted data passed into the unserialize function can be exploited to achieve arbitrary code execution by passing a JavaScript Object with an Immediately Invoked Function Expression IIFE...

CVE-2017-5941

CVE-2017-5941 affects node-serialize version 0.0.4 for Node.js, where untrusted input passed to unserialize() can be crafted as an IIFE to achieve remote code execution. Public writeups (e.g., Packet Storm and Exploit-DB entries) show an RCE payload using the IIFE to spawn a shell via child_proce...