Is CVE-2019-2391 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2019-2391 being exploited in the wild.

How severe is CVE-2019-2391?

Low severity, with a CVSS score of 3.1, published 10 February 2022.

Which products and versions are affected?

MongoDB Js-Bson <1.1.4; bson (npm) SEMVER:introduced=0,fixed=1.1.4.

Is there a fix for CVE-2019-2391?

Yes. bson (npm): upgrade to 1.1.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2019-2391 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2019-2391?

Check whether you run MongoDB Js-Bson or bson (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2019-2391: MongoDB js-bson deserialization of untrusted data

Q: Which products and versions are affected?

MongoDB Js-Bson <1.1.4; bson (npm) SEMVER:introduced=0,fixed=1.1.4.

Q: Is there a fix for CVE-2019-2391?

Yes. bson (npm): upgrade to 1.1.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2019-2391 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2019-2391?

Check whether you run MongoDB Js-Bson or bson (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2019-2391 · Severity: low · CVSS 3.1 · Published 2022-02-10

The MongoDB js-bson library, which is used to serialize and deserialize BSON (binary JSON) data in Node.js and browser applications, contains a flaw in how it parses certain JSON input. An attacker could craft malicious JSON with an invalid _bsontype field that causes the library to serialize data incorrectly, potentially exposing sensitive information. Organizations using vulnerable versions should upgrade to version 1.1.4 or later.

Technologies: bson (npm). Vendors: MongoDB, npm.

Quick answers

Is CVE-2019-2391 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2019-2391 being exploited in the wild.
How severe is CVE-2019-2391?: Low severity, with a CVSS score of 3.1, published 10 February 2022.
Which products and versions are affected?: MongoDB Js-Bson <1.1.4; bson (npm) SEMVER:introduced=0,fixed=1.1.4.
Is there a fix for CVE-2019-2391?: Yes. bson (npm): upgrade to 1.1.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2019-2391 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2019-2391?: Check whether you run MongoDB Js-Bson or bson (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

bson (npm): upgrade to 1.1.4 or later
```
npm install bson@1.1.4
```

Technical details

The vulnerability is a deserialization flaw (CWE-502) in MongoDB's js-bson library affecting versions prior to 1.1.4. The root cause is improper handling of invalid _bsontype fields during BSON serialization of JSON input. An attacker can supply specially crafted JSON with an unrecognized _bsontype value, bypassing expected type validation and causing incorrect serialization behavior. This can lead to data disclosure or unexpected application behavior. The attack requires an application that processes untrusted JSON input with the vulnerable bson library; the exact preconditions (authentication, network accessibility) depend on the application context. A patch was released in version 1.1.4 on March 24, 2020, which properly validates _bsontype fields during serialization.

Affected products

MongoDB js-bson <1.1.4

Identifiers

CVE-2019-2391
GHSA-4jwp-vfvf-657p

Timeline

2020-03-31: disclosed: NVD publication date for CVE-2019-2391
2020-03-24: patched: MongoDB released js-bson v1.1.4 with fix
2022-02-10: advisory: GitHub Security Advisory GHSA-4jwp-vfvf-657p published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.