Executive brief
mongodb-instance is a Node.js package used to manage MongoDB instances. The package downloads executable files over unencrypted HTTP connections, allowing attackers positioned on the network to intercept and replace the downloaded executable with malicious code, leading to remote code execution on the host system.
Technical details
The vulnerability (CWE-311: Missing Encryption of Sensitive Data) exists because mongodb-instance downloads executable resources over unencrypted HTTP rather than HTTPS. An attacker with a privileged network position (e.g., on the same network, via DNS hijacking, or BGP hijacking) can perform a man-in-the-middle attack to intercept the download response and replace the executable with a malicious payload. The attack requires network-level access but no authentication or user interaction. The vulnerability was fixed in version 0.0.3 and later.
Affected products
- npm mongodb-instance all versions prior to 0.0.3
Timeline
- 2019-02-18: disclosed
- 2016: patched: Fixed in version 0.0.3