Search Injection in Mongoose via $where

This repository is a standalone Node.js proof-of-concept lab for CVE-2025-23061, an incomplete fix/bypass of the earlier Mongoose issue CVE-2024-53900. It contains a vulnerable Express application (server.js), an exploit driver (exploit.js), Docker Compose for MongoDB, package metadata, and a placeholder scanner.js. The core issue is unsafe use of attacker-controlled input in Mongoose populate() options, especially nested $where operators inside logical operators such as $and/$or, which are not properly sanitized in affected Mongoose versions. Repository structure: server.js implements the vulnerable demo service and seeds test data; exploit.js sends crafted HTTP requests to trigger the bug; docker-compose.yml provisions MongoDB 7.0 on port 27017; package.json/package-lock.json define dependencies including express, debug, and mongoose 8.9.4; README.md documents affected versions, setup, and example payloads; scanner.js is non-functional placeholder content. Main exploit capabilities: The exploit can initialize the lab via POST /setup, then send malicious populate match/query objects to GET /posts, GET /posts-2, or POST /posts/search. Demonstrated outcomes include unauthorized retrieval of admin-associated data using predicates like this.isAdmin, broad data extraction using always-true conditions, field/property enumeration, denial of service via sleep() or infinite loops, and attempted process-level impact/RCE-style behavior through expressions referencing global.process, child_process, fs, and outbound HTTPS requests. The active exploit path in exploit.js targets /posts-2 with a crafted populate object and a $where expression that attempts process termination via global.process.exit(1). Overall, this is a real exploit PoC rather than a detector. It is operational because it includes both a vulnerable target application and working exploit requests, though payloads are mostly hardcoded demonstrations rather than a generalized exploitation framework.

This repository provides a full proof-of-concept (PoC) and vulnerable environment for CVE-2024-53900, a critical remote code execution (RCE) vulnerability in Mongoose (<8.8.3) when using the populate().match method with user-controlled $where queries. The exploit leverages a crafted HTTP GET request to the vulnerable endpoint (e.g., /book/{OBJECT_ID}/detail) with query parameters that inject a malicious $where clause, resulting in arbitrary JavaScript execution on the server. The PoC demonstrates code execution by launching a calculator (xcalc) on the server. The repository includes a vulnerable Node.js application (app/server.js), Docker setup for both the app and MongoDB, an automated exploit script (exploit.py), and a Nuclei template for detection. The main attack vector is network-based, targeting the exposed HTTP API. The exploit is operational, providing a working payload and environment for testing. Key endpoints include the vulnerable HTTP API and the MongoDB backend. The repository is well-structured for research and demonstration purposes, with clear documentation and setup instructions.