Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CVE-2022-29078 PoC — Github ejs 代码注入漏洞

Source
https://github.com/liam-star-black-master/expluatation_CVE-2022-29078
Associated Vulnerability
Title:Github ejs 代码注入漏洞 (CVE-2022-29078)
Description:The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).
File Snapshot

 [4.0K]  /data/pocs/9b6d3e3d5e2779043b8681779a339e0ad66e1071
├── [ 924]  app.js
├── [ 177]  Dockerfile
├── [ 253]  package.json
├── [ 49K]  package-lock.json
└── [4.0K]  views
    ├── [4.0K]  pages
    │   ├── [ 406]  about.ejs
    │   ├── [ 462]  articles.ejs
    │   ├── [ 246]  index.ejs
    │   └── [  49]  page.ejs
    └── [4.0K]  partials
        ├── [ 553]  footer.ejs
        ├── [ 537]  head.ejs
        └── [1.0K]  header.ejs

3 directories, 11 files
Shenlong Bot has cached this for you
Remarks
    1. It is advised to access via the original source first.
    2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.
    3. Mirroring, verifying, and maintaining this POC archive takes ongoing effort, so local snapshots are a paid feature. Your subscription keeps the archive online — thank you for the support. View subscription plans →