nuclei-templates/misconfiguration/unauthenticated-mongo-expre...

28 lines
605 B
YAML

id: unauthenticated-mongo-express
info:
name: Mongo Express Unauthenticated
author: dhiyaneshDK,b0rn2r00t
severity: high
reference:
- https://www.exploit-db.com/ghdb/5684
tags: mongo,unauth
requests:
- method: GET
path:
- '{{BaseURL}}'
- '{{BaseURL}}/mongo-express/'
- '{{BaseURL}}/db/admin/system.users'
matchers-condition: and
matchers:
- type: word
words:
- '<title>Home - Mongo Express</title>'
- '<title>system.users - Mongo Express</title>'
condition: or
- type: status
status:
- 200