| タイトル | CodeGenieApp serverless-express <=4.17.1 Property Injection |
|---|
| 説明 | The application's /users endpoint accepts arbitrary JSON in the filter query parameter and uses it to dynamically access object properties without validation. This allows authenticated attackers to enumerate database schema, inspect prototype chains, and perform reconnaissance against the application's data structures. While currently limited to information disclosure, this vulnerability provides attackers with valuable schema knowledge that can facilitate targeted attacks. |
|---|
| ソース | ⚠️ https://github.com/AnalogyC0de/public_exp/issues/19 |
|---|
| ユーザー | Ana10gy (UID 93358) |
|---|
| 送信 | 2026年03月01日 00:27 (6 月 ago) |
|---|
| モデレーション | 2026年03月11日 17:51 (11 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 350474 [CodeGenieApp serverless-express 迄 4.17.1 Users Endpoint utils/dynamodb.ts filter 特権昇格] |
|---|
| ポイント | 20 |
|---|