mongo-express up to 0.53.x Endpoint toBSON Command code injection

Summaryinfo

A vulnerability labeled as critical has been found in mongo-express up to 0.53.x. Affected is the function toBSON of the component Endpoint. The manipulation as part of Command results in code injection. This vulnerability is identified as CVE-2019-10758. The attack can be executed remotely. Additionally, an exploit exists. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in mongo-express up to 0.53.x. It has been classified as critical. Affected is the function toBSON of the component Endpoint. The manipulation as part of a Command leads to a code injection vulnerability. CWE is classifying the issue as CWE-94. The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method. A misuse of the `vm` dependency to perform `exec` commands in a non-safe environment.

The weakness was released 12/24/2019. This vulnerability is traded as CVE-2019-10758 since 04/03/2019. The exploitability is told to be easy. It is possible to launch the attack remotely. A authentication is necessary for exploitation. Technical details and a exploit are known. The MITRE ATT&CK project declares the attack technique as T1059.

It is declared as attacked. This issue was added on 12/10/2021 to the CISA Known Exploited Vulnerabilities Catalog with a due date of 06/10/2022:

Apply updates per vendor instructions.

Upgrading to version 0.54.0 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• mongo-express

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11
• 0.12
• 0.13
• 0.14
• 0.15
• 0.16
• 0.17
• 0.18
• 0.19
• 0.20
• 0.21
• 0.22
• 0.23
• 0.24
• 0.25
• 0.26
• 0.27
• 0.28
• 0.29
• 0.30
• 0.31
• 0.32
• 0.33
• 0.34
• 0.35
• 0.36
• 0.37
• 0.38
• 0.39
• 0.40
• 0.41
• 0.42
• 0.43
• 0.44
• 0.45
• 0.46
• 0.47
• 0.48
• 0.49
• 0.50
• 0.51
• 0.52
• 0.53

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion