Executive brief
mongo-express is a Node.js web-based MongoDB administration interface. An authenticated attacker can execute arbitrary code on the host machine by injecting malicious JavaScript into the index creation field, potentially leading to full system compromise.
Technical details
The vulnerability is a code injection flaw (CWE-94) in the index creation functionality of mongo-express. The vulnerable component uses unsafe JavaScript evaluation (eval-like behavior) to process user-supplied input in the "create index" field without proper sanitization. An authenticated user can inject arbitrary JavaScript code that executes in the context of the Node.js process, allowing them to invoke system commands via child_process module. The attack requires authentication to the mongo-express interface but no additional user interaction. The patch was released in version 0.54.0, which implements proper input validation and removes unsafe evaluation patterns.
Affected products
- mongo-express mongo-express all versions prior to 0.54.0
Timeline
- 2019-12-30: disclosed
- 2019-12-30: patched: Version 0.54.0 released
- 2019-12-24: exploited: Exploited in the wild per CISA KEV
- kev added: Listed in CISA Known Exploited Vulnerabilities catalog