POC Details: f66a8317a46a0f12d1bd67f6a3522c9c103f0853

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/arangodb/arangodb-auth-bypass.yaml

Associated Vulnerability

ArangoDB - Authentication Bypass via URL-Encoded Underscore (%5f) to RCE Detection template

Description

ArangoDB <= 3.12.10.1 contains an authentication bypass in the default server.authentication-system-only=true mode (GHSA-rrgq-978q-36mq). The auth gate evaluates the raw URL while action dispatch uses URL-decoded suffixes. Encoding the leading underscore as %5f makes protected /_api/simple/* actions appear public to the auth gate but dispatches as privileged system actions, allowing unauthenticated read/write of the _users collection including password hashes.Chained with GHSA-rvhw-4hpw-9vrx (client-controlled isSystem:true in REST task creation), this yields root-context command execution in the official container image where arangod runs as UID 0.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →