CVEs-PoC/2015/CVE-2015-4412.md

CVE-2015-4412

Description

BSON injection vulnerability in the legal? function in BSON (bson-ruby) gem before 3.0.4 for Ruby allows remote attackers to cause a denial of service (resource consumption) or inject arbitrary data via a crafted string.

POC

Reference

• https://sakurity.com/blog/2015/06/04/mongo_ruby_regexp.html
• https://sakurity.com/blog/2015/06/04/mongo_ruby_regexp.html

Github

• https://github.com/ARPSyndicate/cvemon