Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CVE-2022-29078 PoC — Github ejs 代码注入漏洞

Source
https://github.com/shurochka1396/expluatation_CVE-2022-29078
Associated Vulnerability
Title:Github ejs 代码注入漏洞 (CVE-2022-29078)
Description:Github ejs是嵌入式 JavaScript 模板。 ejs 3.1.6 版本存在代码注入漏洞，该漏洞源于 settings[view options][outputFunctionName] 中可以进行服务器端模板注入。 这被解析为内部选项，并使用任意 OS 命令（在模板编译时执行）覆盖 outputFunctionName 选项。
File Snapshot

 [4.0K]  /data/pocs/3a0f03f8c05d25a2112cd710805f2878b4fc13b3
├── [ 924]  app.js
├── [ 177]  Dockerfile
├── [ 253]  package.json
├── [ 49K]  package-lock.json
└── [4.0K]  views
    ├── [4.0K]  pages
    │   ├── [ 406]  about.ejs
    │   ├── [ 462]  articles.ejs
    │   ├── [ 246]  index.ejs
    │   └── [  49]  page.ejs
    └── [4.0K]  partials
        ├── [ 553]  footer.ejs
        ├── [ 537]  head.ejs
        └── [1.0K]  header.ejs

3 directories, 11 files
Shenlong Bot has cached this for you
Remarks
    1. It is advised to access via the original source first.
    2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).
    3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.