nodejshell

NODEJSHELL - NodeJs デシリアライズにおけるリバースシェルエクスプロイト CVE-2017-5941 このエクスプロイトは、自動的にリバースシェルのペイロードを生成します。ペイロードは10進数にエンコードされ、その後Base64にエンコードされます。 その後、このペイロードはHTTP POSTリクエストを介して送信され、ユーザーの入力をシリアライズしてクッキーに保存します。 そして、GETリクエストを介してアクセスすることでRCEを達成します。 使用方法: python3 nodejshell.py lhost : あなたのローカルIPアドレス lport :...

CVE-2017-5941-NodeJS-RCE

CVE-2017-5941-NodeJS-RCE https://paper.seebug.org/213/...

RCE-NodeJs

node-serialize — CVE-2017-5941 注意: この文書は防御および教育目的のみです。エクスプロイトやRCEを作成するための指示は含まれていません。 要約: node-serialize 0.0.4および類似の古いバージョン は信頼できないデシリアライゼーションによりリスクを引き起こす可能性があります — 入力データを unserialize する前に常に検証してください。 検出: コード内で serialize.unserialize または node-serialize の存在を検索してください。デコードされたBase64クッキー/パラメータを...

CVE-2017-5941

creationtimestamp| type| source ---|---|--- 2025-10-12 15:00:06+00:00| published-proof-of-concept| Telegram/nHH3EPNLC7cR6YqxoW514LvTLwhWMDWIdjARrLyJXH8zbM 2026-07-29 12:00:32+00:00| seen| https://t.me/CVEhub/12576 2026-07-30 00:00:57+00:00| seen| https://t.me/CVEhub/12576 2026-07-31 00:00:08+00:0...

Node.JS - 'node-serialize' Remote Code Execution (3)

Exploit Title: Node.JS - 'node-serialize' Remote Code Execution 3 Date: 17.06.2021 Exploit Author: Beren Kuday GORUN Vendor Homepage: https://github.com/luin/serialize Software Link: https://github.com/luin/serialize Version: 0.0.4 Tested on: Windows & Ubuntu CVE : 2017-5941 var serialize =...

Node.JS Remote Code Execution

Exploit Title: Node.JS - 'node-serialize' Remote Code Execution 3 Date: 17.06.2021 Exploit Author: Beren Kuday GORUN Vendor Homepage: https://github.com/luin/serialize Software Link: https://github.com/luin/serialize Version: 0.0.4 Tested on: Windows & Ubuntu CVE : 2017-5941 var serialize =...

Node.JS - (node-serialize) Remote Code Execution Exploit (3)

Exploit Title: Node.JS - 'node-serialize' Remote Code Execution 3 Exploit Author: Beren Kuday GORUN Vendor Homepage: https://github.com/luin/serialize Software Link: https://github.com/luin/serialize Version: 0.0.4 Tested on: Windows & Ubuntu CVE : 2017-5941 var serialize = require'node-serialize...

Node.js Remote Code Execution (CVE-2017-5941)

A remote code execution vulnerability exists in Node.js. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Node.JS Remote Code Execution

Exploit Title: Node.JS - 'node-serialize' Remote Code Execution 2 Exploit Author: UndeadLarva Software Link: https://www.npmjs.com/package/node-serialize Version: 0.0.4 CVE: CVE-2017-5941 import requests import re import base64 import sys url = 'http://192.168.100.133:8000/' change this payload =...

Node.JS - 'node-serialize' Remote Code Execution (2)

Exploit Title: Node.JS - 'node-serialize' Remote Code Execution 2 Exploit Author: UndeadLarva Software Link: https://www.npmjs.com/package/node-serialize Version: 0.0.4 CVE: CVE-2017-5941 import requests import re import base64 import sys url = 'http://192.168.100.133:8000/' change this payload =...

logostech.net Cross Site Scripting vulnerability OBB-1192798

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

asics.com Cross Site Scripting vulnerability

Security Researcher Tech4 Helped patch 28 vulnerabilities Received 1 Coordinated Disclosure badges Received 1 recommendations , a holder of 1 badges for responsible and coordinated disclosure, found a security vulnerability affecting asics.com website and its users. Following coordinated and...

@contrast/loopback-test-bench (3.15.0), @contrast/test-bench-utils (>=2.7.0, <=3.38.0) +34 more potentially affected by CVE-2017-5941 via node-serialize (>=0.0.3, <=0.0.4)

node-serialize NPM version =0.0.3, =2.7.0, =1.1.0, =1.0.1, =1.0.0, =1.1.1, =1.0.0, =1.0.4, =1.0.0, =1.0.0, =0.0.1, =1.0.4 and more Source cves: CVE-2017-5941 Source advisory: OSV:GHSA-Q4V7-4RHW-9HQM...

CVE-2017-5941

An issue was discovered in the node-serialize package 0.0.4 for Node.js. Untrusted data passed into the unserialize function can be exploited to achieve arbitrary code execution by passing a JavaScript Object with an Immediately Invoked Function Expression IIFE...

CVE-2017-5941

An issue was discovered in the node-serialize package 0.0.4 for Node.js. Untrusted data passed into the unserialize function can be exploited to achieve arbitrary code execution by passing a JavaScript Object with an Immediately Invoked Function Expression IIFE...

CVE-2017-5941

CVE-2017-5941 affects node-serialize version 0.0.4 for Node.js, where untrusted input passed to unserialize() can be crafted as an IIFE to achieve remote code execution. Public writeups (e.g., Packet Storm and Exploit-DB entries) show an RCE payload using the IIFE to spawn a shell via child_proce...