Is CVE-2018-13863 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2018-13863 being exploited in the wild.

How severe is CVE-2018-13863?

Low severity, with a CVSS score of 3, published 17 September 2018.

Which products and versions are affected?

MongoDB Js-Bson 0.5.0 to 1.0.4; bson (npm) SEMVER:introduced=0.5.0,fixed=1.0.5.

Is there a fix for CVE-2018-13863?

Yes. bson (npm): upgrade to 1.0.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2018-13863 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2018-13863?

Check whether you run MongoDB Js-Bson or bson (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2018-13863: MongoDB js-bson regular expression denial of service

CVE-2018-13863 · Severity: low · CVSS 3 · Published 2018-09-17

js-bson is a JavaScript library used to serialize and deserialize data for MongoDB. A flaw in the Decimal128 number parser allows attackers to cause a denial of service by providing a long malicious string that triggers excessive regex backtracking, consuming CPU and freezing the application.

Technologies: bson (npm). Vendors: MongoDB, npm.

Quick answers

Is CVE-2018-13863 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2018-13863 being exploited in the wild.
How severe is CVE-2018-13863?: Low severity, with a CVSS score of 3, published 17 September 2018.
Which products and versions are affected?: MongoDB Js-Bson 0.5.0 to 1.0.4; bson (npm) SEMVER:introduced=0.5.0,fixed=1.0.5.
Is there a fix for CVE-2018-13863?: Yes. bson (npm): upgrade to 1.0.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2018-13863 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2018-13863?: Check whether you run MongoDB Js-Bson or bson (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

bson (npm): upgrade to 1.0.5 or later
```
npm install bson@1.0.5
```

Technical details

The vulnerability is a Regular Expression Denial of Service (ReDoS) in the Decimal128.fromString() function in lib/bson/decimal128.js. When parsing an untrusted input string, a catastrophic backtracking regex allows an attacker to cause exponential CPU consumption by submitting a carefully crafted long string. The vulnerability affects versions 0.5.0 through 1.0.4. An attacker with network access can trigger this by sending a malicious Decimal128 value to any application using affected js-bson versions. The fix, available in version 1.0.5, adds a string length guard that rejects inputs exceeding 7000 characters.

Affected products

MongoDB js-bson 0.5.0 to 1.0.4

Identifiers

CVE-2018-13863
GHSA-8462-q7x7-g2x4

Timeline

2018-09-17: disclosed
2018-09-17: patched: Fixed in version 1.0.5

References

https://github.com/mongodb/js-bson/commit/bd61c45157c53a1698ff23770160cf4783e9ea4a

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.