f41k0n/rce-nodejsExploit Title: Node.JS - 'node-serialize' Remote Code Execution (2), Version: 0.0.4, CVE: CVE-2017-5941
Note: This document is for defense and educational purposes only. No instructions for creating exploits or RCE are included.
Summary: node-serialize (0.0.4 and similar outdated versions) may pose a risk due to untrusted deserialization — always validate input before calling unserialize().
Detection: Search for serialize.unserialize() or node-serialize in the code. Check decoded base64 cookies/parameters for _$$ND_FUNC$$_, function(, or eval(.
Mitigation (quick):
node-serialize; use JSON.parse/.JSON.stringifyeval and dynamic code execution.Test (harmless): only send benign base64-JSON (no functions or shell commands) — test only with permission.
Contact / Additional: if needed, I can prepare a CI script, Express middleware, or part of an incident playbook.