Arbitrary Code Injection in Underscore.js template Function

This repository contains a working exploit for CVE-2021-23358, a code injection vulnerability in the 'underscore' Node.js library. The main files of interest are: - **app.js**: A Node.js Express web application that demonstrates the vulnerability. It exposes a web form at `http://localhost:3000/` with two inputs. The first input (`input1`) is processed unsafely by assigning its value to `_.templateSettings.variable`, leading to code injection if a malicious payload is supplied. The second input is sanitized. - **exploitCVE.py**: An automated exploit script written in Python. It uses Selenium to interact with the vulnerable web form, injects a payload into the vulnerable input field, and submits the form. The default payload opens a reverse shell to the attacker's machine, but a custom payload can also be specified. - **cve-2021-23358.sh**: A detection script that checks for vulnerable versions of the 'underscore' library on the system, both via npm and by searching the filesystem. The exploit demonstrates remote code execution by leveraging the vulnerable input field in the web application. The attacker can use the provided Python script to automate exploitation, specifying the target URL, input field ID, and payload. The repository also includes a detection script to help identify vulnerable installations of the 'underscore' library. The main attack vector is via a web form exposed by a Node.js application using a vulnerable version of 'underscore'. The exploit is operational and provides a real payload (reverse shell), making it suitable for demonstrating the impact of the vulnerability.