webeasy

Secure Notes

hackthebox

Task: Access a flag endpoint restricted to localhost on a Node.js app with Mongoose 7.2.4 and MongoDB. Solution: Exploit CVE-2023-3696 Mongoose prototype pollution via $rename operator to set __proto__._peername.address to "127.0.0.1", which is inherited by Node.js socket objects when checking req.connection.remoteAddress, bypassing the IP check.

$ ls tags/ techniques/
nodejsprototype_pollutionmongodbcvemongooseip_bypass
prototype_pollution_via_renamenodejs_internal_gadgetip_spoofing_via_prototype
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Create a free account with GitHub, then upgrade to Pro.

$ssh [email protected]