CVE-2024-53900

CTF チャレンジ - Mongoose RCE CVE-2024-53900 チャレンジ概要 この Capture The Flag CTF チャレンジは、Mongoose の脆弱性 CVE-2024-53900 に基づいています。この脆弱性は、MongoDB クエリ内の $where 演算子の不適切な使用により、リモートコード実行 RCE を可能にします。 あなたの目標は、この脆弱性を悪用して、アプリケーション内に隠されたフラグを取得することです！ セットアップ手順 1 依存関係のインストール Node.js がインストールされていることを確認し、次のコマンドを実行します：...

CVE-2024-53900

CVE-2024-53900 - Mongoose populate.match $where RCE 이 저장소는 Mongoose 8.8.3에서 발생하는 심각한 원격 코드 실행RCE 취약점인 CVE-2024-53900 에 대한 재현 가능한 취약 환경과 PoC를 제공합니다. 📌 취약점 세부 정보 CVE : CVE-2024-53900 영향받는 버전 : Mongoose 8.8.3 심각도 : 심각 CVSS 9.1 벡터 : populate.match와 $where의 결합 영향 : Node.js 컨텍스트에서 임의 JavaScript 실행 RCE ...

EUVD-2026-57821

Budibase before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB datasource integration where user-supplied parameters are enriched with handlebars using noEscaping: true and parsed without operator filtering. Attackers can inject MongoDB operators through query parameters to bypass...

The vulnerability of the populate() function in the Mongoose library allows a hacker to execute arbitrary code and gain access to read and modify data.

The vulnerability of the populate function in the Mongoose library is related to improper code generation when using the $where operator. Exploiting this vulnerability allows an attacker to execute arbitrary code and gain access to read and modify data...

The vulnerability of the Mongoose library, related to the lack of protection for SQL query structures, allows attackers to execute arbitrary code and gain access to read and modify data.

The vulnerability of the Mongoose library relates to the lack of protection for the SQL query structure when the $where operator is used. Exploiting this vulnerability allows an attacker to execute arbitrary code and gain access to read and modify data...

GHSA-VG7J-7CWX-8WGW Mongoose search injection vulnerability

Mongoose versions prior to 8.9.5, 7.8.4, and 6.13.6 are vulnerable to improper use of the $where operator. This vulnerability arises from the ability of the $where clause to execute arbitrary JavaScript code in MongoDB queries, potentially leading to code injection attacks and unauthorized access...

GHSA-M7XQ-9374-9RVX Mongoose search injection vulnerability

Mongoose versions prior to 8.8.3, 7.8.3, 6.13.5, and 5.13.23 are vulnerable to improper use of the $where operator. This vulnerability arises from the ability of the $where clause to execute arbitrary JavaScript code in MongoDB queries, potentially leading to code injection attacks and unauthoriz...

PT-2024-35970

Name of the Vulnerable Software and Affected Versions Mongoose versions prior to 8.8.3 Description The issue is related to the improper use of the $where operator in Mongoose, which can lead to search injection and potentially allow a remote attacker to execute arbitrary code and gain read and...