what you don't know can hurt you

Register | Login

FilesNewsUsersAuthors

Home Files News &[SERVICES_TAB]About Contact Add New

Showing 1 - 1 of 1

Files from Jarda Kotesovec

Bassmaster Batch Arbitrary JavaScript Injection Remote Code Execution

Posted Oct 30, 2016

Authored by mr_me, Jarda Kotesovec | Site metasploit.com

This Metasploit module exploits an un-authenticated code injection vulnerability in the bassmaster nodejs plugin for hapi. The vulnerability is within the batch endpoint and allows an attacker to dynamically execute JavaScript code on the server side using an eval. Note that the code uses a '\x2f' character so that we hit the match on the regex.

tags | exploit, javascript

advisories | CVE-2014-7205

SHA-256 | ee20d372ed0f1e30bd8d9b8a767eee792e35e7aba086370b04a670a286abf66e

Download | Favorite | View